EUVD-2026-100976

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-86799 Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any...

CVE-2026-86799

The Forms WordPress plugin (versions before 3.0.2 ) is vulnerable to unauthenticated stored XSS via form submission. The application fails to sanitise submitted form values upon storage and fails to escape those values before they are rendered on the form submissions screen in the administration ...

crawlergo

crawlergo A powerful browser crawler for web vulnerability scanners English Document | 中文文档 crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with...

CVE-2025-52122

CVE CraftCMS Freeform CraftCMS Freeform contains an SSTI vulnerability, resulting in arbitrary code injection for all users that have access to editing a form submission title. Vulnerable versions are v5.0.0 test % set form = freeform.form'pentest' % % if form % form.render % else % Form not foun...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2026-96227

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2026-19500-poc

CVE-2026-19500 Poc and writeup Description Sureforms is vulnerable to a DOS vulnerability , when attacker can submit unlimited key-value pair, leads to resource exhaustion and the administrator can not watch entries temporary. How to reproduce Submit the Form which is made by Sureforms plugin, an...

EUVD-2026-93501

Payload Form Builder has an RCE issue...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857

The Payload headless content management system is vulnerable to Remote Code Execution (RCE) via the @payloadcms/plugin-form-builder component. An attacker can exploit this by crafting a malicious form submission to execute code remotely on the server. This issue is linked to CWE-94 (Code Injectio...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

PT-2026-106790

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-form-builder versions prior to 3.90.0 @payloadcms/plugin-form-builder versions prior to 4.0.0-canary.34 Description An issue exists where the plugin mishandles crafted form submission payloads, allowing an unauthenticated...

CVE-2026-105857: Improper Control of Generation of Code

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...

PT-2026-99063

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to validate write passwords on submission endpoints, performing the check only on the front end. This allows remote unauthenticated attackers to submit form entries directl...