PT-2022-13454

Name of the Vulnerable Software and Affected Versions FormBuilder WordPress plugin versions 1.08 and earlier Description The issue concerns the lack of CSRF checks when creating, updating, and deleting forms, as well as insufficient sanitization and escaping of form field values. This allows...

CVE-2022-0830: Cross-Site Request Forgery (CSRF)

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put...

GHSA-Q863-CCHM-C6C6 SQL Injection in Fork CMS

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable to SQL injection...

SQL Injection in Fork CMS

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable to SQL injection...

PT-2022-12998

Name of the Vulnerable Software and Affected Versions Fork CMS versions prior to 5.11.1 Description The issue concerns a SQL injection vulnerability. When deleting submissions that belong to a form created with the FormBuilder module, the parameter id is vulnerable to SQL injection. Recommendatio...

FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in...

FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in...

SQL Injection in forkcms/forkcms

Description When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable for SQL injection. Proof of Concept - Call the URL...

Cross-site Scripting (XSS) - Stored in forkcms/forkcms

✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter 🕵️‍♂️ Proof of Concept XSS payload: '"%26%25alert1 Steps to reproduce issue 1- Login to Fork admin panel 2- Goto Modules=Formbuilder 3- Turn on Burp...

WordPress formbuilder plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress formbuilder plugin. An attacker can exploit this...

WordPress formbuilder plugin cross-site scripting vulnerability (CNVD-2019-32410)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. A cross-site scripting vulnerability exists in the WordPress formbuilder plugin. An attacker can exploit the vulnerability to execute client-side code...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2012-6715

The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2012-6715

The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header...

Cross site scripting

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2016-10910

The CVE-2016-10910 refers to the WordPress FormBuilder plugin. Affected component: FormBuilder plugin before version 1.06 for WordPress. Description in sources: multiple cross-site scripting (XSS) issues. Practical impact stated: client-side code execution via XSS; exploitation details are not pr...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2012-6715

The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header...