WordPress Form Maker by 10Web plugin < 1.15.45 - Subscriber+ SQL Injection via display_name vulnerability

Subscriber+ SQL Injection via displayname vulnerability discovered by Revanth Meesala in WordPress Plugin Form Maker by 10Web versions 1.15.45...

Cross Site Scripting

Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

EUVD-2026-58588

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-16810

CVE-2026-16810 affects the Bit Form WordPress plugin up to version 3.2.0. The vulnerability is a generic SQL injection in the data[queryCondition] parameter caused by insufficient escaping and inadequate preparation of the existing SQL query. It requires authenticated access with administrator-le...

CVE-2026-72821: Improper Neutralization of Input During Web Page Generation

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

CVE-2026-16810: Improper Neutralization of Special Elements used in an SQL Command

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

PT-2026-84463

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that leads to excessive memory consumption and long runtimes. This occurs when extracting text from a page containing numerous reused form XObjects, where a form invok...

PT-2026-71964

Name of the Vulnerable Software and Affected Versions Bit Form versions prior to 3.2.1 Description The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress contains a generic SQL Injection flaw. This occurs because the plugin fails to...

PT-2026-71990

Name of the Vulnerable Software and Affected Versions Grav Form plugin versions prior to 9.1.15 Description A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig |raw filter. This allows attackers with form authoring permissions to injec...

CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-58428

The Git repository management system Gitea is vulnerable to an attachment extension allowlist bypass via the web release edit form. An authenticated remote attacker with repository write permissions can exploit flaws in the EditReleasePost() function (in routers/web/repo/release.go) and the Updat...

CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

EUVD-2026-58156

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...