CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...

PT-2026-99061

Name of the Vulnerable Software and Affected Versions TDuck survey form version 6.0 Description An information disclosure issue exists in the hasPermission function of FormAuthUtils. The system fails open when a form does not exist, which allows authenticated users to access deleted form...

CVE-2026-100305: Missing Authorization

TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP...

CVE-2026-100304: Not Failing Securely

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

PT-2026-98372

Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.2 Description Insufficient input sanitization and output escaping in the form data Rich Text Field allow unauthenticated attackers to perform Stored DOM-Based...

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...

EUVD-2026-42394

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict...

GHSA-9643-4QGH-G8MX elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...

CVE-2026-96758

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

EUVD-2026-85408

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96758

The orval @orval/core package, prior to version 8.28.0 , is vulnerable to a code injection flaw in its form-data serializer . The root cause is a failure to escape multipart property names within generated template literals. This allows an attacker to inject ${...} expressions into OpenAPI schema...

PT-2026-97411

Name of the Vulnerable Software and Affected Versions @orval/core versions prior to 8.28.0 Description A code injection issue exists in the form-data serializer. The component fails to escape multipart property names within generated template literals. This allows attackers to inject $...

CVE-2026-96758: Improper Control of Generation of Code

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in form-data 4.0.5

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source package axios which transitively depends on package form-data, which is affected by a high severity vulnerability. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in form-data (CVE-2026-12143)

Summary An HTTP header injection vulnerability in the form-data multipart stream creation library CVE-2026-12143 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.0.6. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a libra...