sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms This is a SudoWP security fork of the original Crowdsignal Forms plugin. !WARNING Security Notice : The original "Crowdsignal Forms" plugin versions = 1.7.2 contains a critical Missing Authorization vulnerability CVE-2025-69015 allowing authenticated users to modify polls...

CVE-2024-0710

CVE-2024-0710 Vulnerability: CVE-2024-0710 Unauthenticated Form Submission Unique ID Modification CVSS: 5.3 Medium Software: GP Unique ID gp-unique-id Affected versions: = 1.5.5 Patched version: 1.5.6 Developer: Gravity Wiz Researcher: Karl Emil Nikka, Nikka Systems Publicly published: 2024-04-10...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — Vulnerable Docker Lab Reproducible Docker lab for CVE-2017-20192 Formidable Forms 2.05.03 stored XSS. Quickstart docker compose up -d --build Target: http://127.0.0.1:18080 Validate lab helper This helper script: submits a crafted entry unauthenticate...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Unauthenticated Arbitrary File Upload to RCE Exploit for CVE-2026-0740 discovered by Selim Lanouar whattheslime. For a complete technical deep dive, read the full article on Lexfo's blog. Disclaimer This repository is provided for research and...

CVE-2026-0740-mass

CVE-2026-0740 — Mass-Target Exploit Engine Author: 0xNuts Contributor: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC for CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload which can lead to RCE. Original vulnerability discovered by Sél...

CVE-2026-14894

CVE-2026-14894 — Super Forms ≤ 6.3.313 Overview Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313. The vulnerability resides in the AJAX handler supersubmitform which processes file uploads through a datauristring field without...

CVE-2026-56291

Auto Scanning Version & Exploit CVE-2026-56291 POC Joomla Unauthenticated Arbitrary File Upload leading to RCE in Balbooa Forms FOFA / Shodan FOFA: body="combaforms" Shodan: http.html:"baforms"...

CVE-2026-14894

CVE-2026-14894 — Super Forms Unauthenticated File Upload RCE Nonce Leak → datauristring Upload → Code Execution Overview CVE-2026-14894 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin by WebRehab...

CVE-2026-4883

CVE-2026-4883: Piotnet Forms Pro = 2.1.40 - Unauthenticated Arbitrary File Upload → RCE The vulnerability stems from inadequate file type validation in the piotnetformsajaxformbuilder function. The plugin employs an incomplete extension blacklist blocking only php, phpt, php5, php7, and exe while...

AEMPWN

AEMPWN AEM Forms Scanner for CVE-2025-54253 & CVE-2025-54254 AEMPWN is a targeted scanner for identifying high-risk Adobe Experience Manager AEM Forms vulnerabilities, with support for safe detection, blind out-of-band OOB confirmation, and full proof-of-concept PoC validation workflows. This too...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modification Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-12400 CVSS Score| 4.3 — Medium CVSS Vector|...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress. Description main.py scans a list of WordPress targets to determine whether the Ninja Forms File Uploads plugin is vulnerable to CVE-2026-0740. Brief flow: 1...

CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit Pre-Auth form.uploadAttachmentFile → No CSRF → PHP Upload Overview CVE-2026-56291 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Balbooa Forms combaforms Joomla extension CISA KEV: Added July 10, 2026 — acti...

CVE-2026-48866

┌───────────────────────────────────────────────────────────┐ │ │ │ C V E - 2 0 2 6 - 4 8 8 6 6 │ │ │ │ Gravity Forms Path Traversal → Arbitrary File D...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS This repository reveals a security vulnerability discovered in Motivian Content Management System v.41.0.0. CVE-2025-29094: Multiple Stored Cross-Site Scripting XSS This vulnerability was reported to the vendor in accordance with responsible...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "erro...