EUVD-2026-125024

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esignformsubmit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and...

CVE-2026-126419

OpenEMR versions before 8.5.0 are vulnerable to a missing authorization vulnerability within the esign_form_submit handler located in library/ESign/Form/Controller.php. The root cause is that the system verifies the caller's password but fails to validate whether the user has authorized access to...

EUVD-2026-125016

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

CVE-2026-126427

OpenEMR versions before 8.5.0 are vulnerable to an idle session timeout bypass via the Eye Exam form. The root cause is that the read-only poll for this form omits skip_timeout_reset, allowing the update_READONLY() function to reset the idle timer every 15 seconds. An attacker with physical acces...

CVE-2026-120547

The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress (versions

EUVD-2026-124973

The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form CF7 form body; the honeypot ... tag value' parameter in all versions up to, and including, 3.8.0 due to insufficient input...

CVE-2026-128017

FrankenPHP versions prior to 1.13.4 are vulnerable to a double free vulnerability in worker mode . The issue occurs when a worker script ends its loop following a non-form POST request, causing the system to free SG(request_info).content_type_dup twice. Unauthenticated attackers can exploit this ...

EUVD-2026-125068

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator...

CVE-2026-111211

A flaw was found in django. The geometry form field and its widgets directly log invalid user-submitted values without proper escaping. A remote attacker could exploit this by submitting input containing control characters, such as newlines or escape sequences, leading to log injection. This flaw...

WordPress Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin <= 1.0.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by samathakeeling in WordPress Plugin Chatterbug Forms – Fast, Flexible WordPress Form Builder versions = 1.0.2...

CVE-2026-120407

The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta such as two-factor secrets of higher-privileged users,...

CVE-2026-120407

The Contact Form 7 WordPress plugin (versions before 6.2.5 ) contains a vulnerability where form field default values do not restrict which user properties they can be populated from. This flaw allows users with the Editor role or higher to access sensitive information, such as password hashes an...

CVE-2026-120407 Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values

The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta such as two-factor secrets of higher-privileged users,...

WordPress Contact Form 7 plugin < 6.2.5 - Editor+ Sensitive User Data Disclosure vulnerability

Editor+ Sensitive User Data Disclosure vulnerability discovered by Epihack Bénin in WordPress Plugin Contact Form 7 versions 6.2.5...

EUVD-2026-124841

The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta such as two-factor secrets of higher-privileged users,...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

log4j_checker

Log4jchecker.py CVE-2021-44228 Description This Python3 script tries to look for servers vulnerable to CVE-2021-44228, also known as Log4Shell, a very critical vulnerability found in Log4j2 Java logging library. It doesn't rely on external DNS log servers to verify and validate the vulnerable...

-CVE-2015-10137-WordPress-N-Media-Website-Contact-Form-with-File-Upload-1.3.4

WordPress N-Media Website Contact Form with File Uploader File Upload Vulnerability Analysis 1. Vulnerability Point Code Analysis Plugin file: classes/plugin.class.php, method: uploadfile function uploadfile // ... if ! empty $FILES $tempFile = $FILES 'Filedata' 'tmpname'; $targetPath = $dirPath;...

CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 Exploiting: CVE-2021-41349 This exploiting tool creates a Form for posting XSS Payload to the target Exchange server. You need to create a js containing your desire to do. Usage 1. Create Your js Payload and upload it somewhare. 2. run the CVE-2021-41349....