Lucene search
+L

646 matches found

Kitploit
Kitploit
added 2026/09/16 2:45 a.m.14 views

CVE-2026-19500-poc

CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...

7.5CVSS5.9AI score0.00488EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 12:07 a.m.9 views

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

8.8CVSS5.9AI score0.00466EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 6:40 p.m.10 views

crawlergo

crawlergo A powerful browser crawler for web vulnerability scanners English Document | 中文文档 crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with...

6AI score
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/15 12:39 p.m.11 views

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

9.8CVSS6.5AI score0.0061EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 10:47 a.m.9 views

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

7.5CVSS8AI score0.00702EPSS
SaveExploits2
Github Security Blog
Github Security Blog
added 2026/09/10 8:37 p.m.13 views

n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...

6.5CVSS5.7AI score0.00251EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 2026/09/02 4:17 p.m.7 views

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

4.3CVSS0.00186EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.17 views

CVE-2026-84658

Jenkins Script Security Plugin versions 1412.v7737b_3405f86 and earlier are affected by an improper access control vulnerability (SECURITY-3986). The plugin uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration but is not intended to be invoked by use...

4.3CVSS5.9AI score0.00186EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.33 views

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

0.00186EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 2:16 p.m.16 views

CVE-2026-17563

User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...

5.3CVSS5.9AI score0.00221EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 6:00 a.m.19 views

CVE-2026-78151

The FormLayer WordPress plugin (versions before 1.0.9 ) contains an unauthenticated information disclosure vulnerability discovered by Vaibhav Narkhede . The plugin's public form submission handler returns a form's full stored configuration in its response without performing any authorization che...

5.3CVSS5.8AI score0.00206EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/29 12:16 p.m.20 views

CVE-2026-14494

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

9.8CVSS0.00693EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/22 4:16 p.m.17 views

CVE-2026-4703

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

9.8CVSS0.00624EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/22 3:27 p.m.59 views

CVE-2026-4703

WS Form LITE (WordPress plugin) versions up to and including 1.10.80 are vulnerable to unauthenticated PHP Object Injection caused by deserialization of untrusted input from form submission meta values. The plugin itself contains no known POP chain, so the vulnerability has no direct impact unles...

9.8CVSS6.3AI score0.00624EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/22 3:27 p.m.18 views

EUVD-2026-64521

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

9.8CVSS6.3AI score0.00624EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/22 3:27 p.m.34 views

CVE-2026-4703 WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

9.8CVSS0.00624EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/20 7:29 a.m.35 views

CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

8.6CVSS0.0023EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/18 4:17 p.m.10 views

CVE-2026-19500

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing th...

7.5CVSS0.00488EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/08/18 3:21 p.m.30 views

CVE-2026-19500 SureForms contains an uncontrolled resource consumption vulnerability

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing th...

0.00488EPSS
SaveExploits1References2
GithubExploit
GithubExploit
added 2026/08/18 3:16 p.m.29 views

Exploit for CVE-2026-19500

CVE-2026-19500 Poc and writeup Description Sureforms is v...

5.5AI score0.00488EPSS
SaveExploits1
Rows per page
Query Builder