34606 matches found
Malicious code in @servicetitan/form-state (npm)
npm/@servicetitan/form-state is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malware in @servicetitan/form-state
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
WordPress Booking Calendar Contact Form plugin <= 1.0.23 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.0.23...
WordPress Booking Calendar Contact Form plugin <= 1.0.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.0.23...
WordPress Booking Calendar Contact Form plugin <= 1.1.24 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Joaquin Ramirez Martinez in WordPress Plugin Booking Calendar Contact Form versions = 1.1.24...
WordPress Contact Form Builder, Contact Widget plugin <= 1.6.1 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Milad karimi in WordPress Plugin Contact Form Builder, Contact Widget versions = 1.6.1...
WordPress International Sms For Contact Form 7 Integration plugin <= 1.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Milad karimi in WordPress Plugin International Sms For Contact Form 7 Integration versions = 1.2...
Exploit for CVE-2026-17543
PHP CVE-2026-17543 Exposure Validator Safe network-side valid...
WordPress Database for CF7 plugin <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin Database for CF7 versions = 1.2.6...
CVE-2026-14872
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
CVE-2026-14872
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5 ) is vulnerable to SQL Injection due to improper sanitization and escaping of the id parameter within SQL statements. This flaw is exploitable by authenticated users who possess specific capabilities...
CVE-2026-14872
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
EUVD-2026-52587
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
Exploit for Improper Input Validation in Google Chrome
--- CVE-2026-11113 – SMTP Header Injection in Contact Form...
PT-2026-75758
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.0.0-tuxcare.2...
PT-2026-74189
TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.1.4-tuxcare.1...