GHSA-W253-M66G-RX24 Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Summary Coraza fails to inspect URL-encoded form bodies when their valid Content-Type contains a media-type parameter, for example: http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 An unauthenticated attacker can use this header to hide the complete form body from custom Coraza...

CVE-2026-105831

EspoCRM versions before 10.0.6 are vulnerable to an unauthenticated stored HTML injection vulnerability. An attacker can submit crafted data via a Lead Capture public form , which is stored in LeadCaptureLogRecord.data . When an administrator views the log record, the request body is rendered une...

CVE-2026-85486

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...

EUVD-2026-94789

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...

CVE-2026-85486

Brocade ASCG versions prior to 3.5.0 are vulnerable to Remote Code Execution (RCE) due to improper input processing. The software evaluates form data before performing necessary validation. An authenticated user with basic access can submit a configuration form containing crafted input , which th...

CVE-2026-85486

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...

CVE-2026-105260

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

CVE-2026-105260

The Database Addon For WPForms ( wpforms entries ) WordPress plugin affects versions before 1.1.1 . The vulnerability exists because the plugin fails to verify the CSRF nonce when the field is omitted and lacks internal capability checks. This flaw allows an attacker to delete arbitrary stored fo...

CVE-2026-105260 Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

WordPress Database Addon For WPForms ( wpforms entries ) plugin < 1.1.1 - Arbitrary Form Entry Deletion vulnerability

Arbitrary Form Entry Deletion vulnerability discovered by Rik de Kok in WordPress Plugin Database Addon For WPForms wpforms entries versions 1.1.1...

CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

EUVD-2026-94761

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

CVE-2026-17196

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2026-17609

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

EUVD-2026-94737

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2026-85486: Improper Neutralization of Directives in Dynamically Evaluated Code

Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code...

CVE-2026-17196: Unrestricted Upload of File with Dangerous Type

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...

CVE-2026-17609: Unrestricted Upload of File with Dangerous Type

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

CVE-2026-103646: Improper Authentication

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the looku...

PT-2026-107808

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload files function. This is due to missing file type validation in the upload files function, which reads and applies an...