CVE-2026-15255

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

PT-2026-66398

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

axios: axios: Denial of Service via uncontrolled recursion in form data processing

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

GHSA-PX9F-WHJ3-246M Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

Summary Req's multipart form encoder interpolates the per-part name, filename, and contenttype directly into the part headers without escaping. An attacker who can influence any of those values can inject CRLF-separated header lines, smuggle additional form fields, or prepend a whole extra part...

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

Summary Req's multipart form encoder interpolates the per-part name, filename, and contenttype directly into the part headers without escaping. An attacker who can influence any of those values can inject CRLF-separated header lines, smuggle additional form fields, or prepend a whole extra part...

openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory. - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. -...

axios: axios: Denial of Service via uncontrolled recursion in form data processing

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

CVE-2026-12741

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-12741

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-12741

CVE-2026-12741 affects the WordPress plugin WP Fast Total Search – The Power of Indexed Search, vulnerable via the form_data[s] parameter. All versions up to 1.80.280 fail to properly escape the user-provided input and do not sufficiently prepare the SQL query, enabling unauthenticated attackers ...

EUVD-2026-49716

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

OPENSUSE-SU-2026:21448-1 Security update for agama-web-ui

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames bsc1272310....

PT-2026-65410

Name of the Vulnerable Software and Affected Versions WP Fast Total Search – The Power of Indexed Search versions prior to 1.80.281 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)

Summary IBM Security SOAR uses an older version of the form-data component that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.10.2 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION:...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

GHSA-HCPX-6FM6-WX23 Axios form serializer maxDepth bypass via {} metatoken

Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending in , axios calls JSON.stringify on that value before the formSerializer.maxDepth guard can inspect...