Payload Form Builder has an RCE issue

Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34...

@ainsleydev/payload-helper (>=0.0.24, <=0.3.2), @contentql/core (>=0.3.1, <=0.3.5) +1 more potentially affected by CVE-2026-105857 via @payloadcms/plugin-form-builder (>=3.0.0-beta.111, <=3.86.0)

@payloadcms/plugin-form-builder NPM version =3.0.0-beta.111, =0.0.24, =0.3.1, =0.3.5 - kollab-payload-template 1.0.0 Source cves: CVE-2026-105857 Source advisory: SNYK:JS-PAYLOADCMSPLUGINFORMBUILDER-20936877...

GHSA-R488-J9VJ-WX3Q Payload Form Builder has an RCE issue

Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34...

@ainsleydev/payload-helper (>=0.0.24, <=0.3.2), @contentql/core (>=0.3.1, <=0.3.5) +1 more potentially affected by CVE-2026-105857 via @payloadcms/plugin-form-builder (>=3.0.0-beta.111, <=3.86.0)

@payloadcms/plugin-form-builder NPM version =3.0.0-beta.111, =0.0.24, =0.3.1, =0.3.5 - kollab-payload-template 1.0.0 Source cves: CVE-2026-105857 Source advisory: OSV:GHSA-R488-J9VJ-WX3Q...

@ainsleydev/payload-helper (>=0.0.24, <=0.3.2), @contentql/core (>=0.3.1, <=0.3.5) +1 more potentially affected by CVE-2026-105857 via @payloadcms/plugin-form-builder (>=3.0.0-beta.111, <=3.86.0)

@payloadcms/plugin-form-builder NPM version =3.0.0-beta.111, =0.0.24, =0.3.1, =0.3.5 - kollab-payload-template 1.0.0 Source cves: CVE-2026-105857 Source advisory: GHSA-R488-J9VJ-WX3Q...

EUVD-2026-93501

Payload Form Builder has an RCE issue...

Arbitrary Code Injection

Overview @payloadcms/plugin-form-builder is a Form builder plugin for Payload CMS Affected versions of this package are vulnerable to Arbitrary Code Injection via insufficient access control on the FormSubmissions and Forms collections, where the read access check only verifies that a user is...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

@ainsleydev/payload-helper (>=0.0.24, <=0.3.2), @contentql/core (>=0.3.1, <=0.3.5) +3 more potentially affected by CVE-2026-105857 via @payloadcms/plugin-form-builder (>=1.2.3, <=3.86.0)

@payloadcms/plugin-form-builder NPM version =1.2.3, =0.0.24, =0.3.1, =1.0.117, =1.0.118 - kollab-payload-template 1.0.0 - yak-payload-testbed 1.2.3 Source cves: CVE-2026-105857 Source advisory: MEND:CVE-2026-105857...

CVE-2026-105857

The Payload headless content management system is vulnerable to Remote Code Execution (RCE) via the @payloadcms/plugin-form-builder component. An attacker can exploit this by crafting a malicious form submission to execute code remotely on the server. This issue is linked to CWE-94 (Code Injectio...

CVE-2026-105857: Improper Control of Generation of Code

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

PT-2026-106790

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-form-builder versions prior to 3.90.0 @payloadcms/plugin-form-builder versions prior to 4.0.0-canary.34 Description An issue exists where the plugin mishandles crafted form submission payloads, allowing an unauthenticated...

CVE-2026-85602

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

Malware in strapi-plugin-form

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview strapi-plugin-form is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages aren't...

Linux Distros Unpatched Vulnerability : CVE-2022-35946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licens...

WordPress Plugin Form Maker by 10Web has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...