SQL Injection in Fork CMS

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable to SQL injection...

FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in...

FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in...

SQL Injection in forkcms/forkcms

Description When deleting submissions which belong to a formular made with module FormBuilder, the parameter id is vulnerable for SQL injection. Proof of Concept - Call the URL...

Cross-site Scripting (XSS) - Stored in forkcms/forkcms

✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter 🕵️‍♂️ Proof of Concept XSS payload: '"%26%25alert1 Steps to reproduce issue 1- Login to Fork admin panel 2- Goto Modules=Formbuilder 3- Turn on Burp...

WordPress formbuilder plugin cross-site scripting vulnerability (CNVD-2019-32410)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. A cross-site scripting vulnerability exists in the WordPress formbuilder plugin. An attacker can exploit the vulnerability to execute client-side code...

WordPress formbuilder plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress formbuilder plugin. An attacker can exploit this...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2012-6715

The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header...

CVE-2012-6715

The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header...

Cross site scripting

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2016-10910

The formbuilder plugin before 1.06 for WordPress has multiple XSS issues...

CVE-2016-10910

The CVE-2016-10910 refers to the WordPress FormBuilder plugin. Affected component: FormBuilder plugin before version 1.06 for WordPress. Description in sources: multiple cross-site scripting (XSS) issues. Practical impact stated: client-side code execution via XSS; exploitation details are not pr...

CVE-2012-6715

CVE-2012-6715 concerns the WordPress Formbuilder plugin, affected versions before 0.9.1. The vulnerability is a stored/reflective XSS via the Referer header, enabling execution of malicious client-side scripts. Documented impact is cross-site scripting; exploitation details beyond this risk descr...

IkiWiki Authentication Bypass Vulnerability

A flaw, similar to CVE-2016-9646 exists in the passwordauth plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Authentication flaw

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters...

CVE-2017-0356

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters...

DEBIAN-CVE-2016-9646

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

Design/Logic Flaw

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...