CVE-2025-13657

The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the handlequeryargs function. This makes it possible for unauthenticated attackers to update the plugin's...

WordPress Forminator plugin <= 1.35.1 - Missing Authorization to Authenticated Form Update and Creation vulnerability

Missing Authorization to Authenticated Form Update and Creation vulnerability discovered by wesley wcraft in WordPress Plugin Forminator versions = 1.35.1...

Multi Step Form < 1.7.13 - Form Update/Deletion via CSRF

Description The plugin does not have CSRF checks when deleting, updating and duplicating forms, which could allow attackers to make logged in admins perform such actions via CSRF attacks...

PT-2019-9618 · Gnuboard · Gnuboard5

Name of the Vulnerable Software and Affected Versions: GNUBOARD5 version 5.3.1.9 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the bo content head parameter, also known as the "board head contents" parameter, in the adm/board form update.php endpoint...

PT-2019-9617 · Gnuboard · Gnuboard5

Name of the Vulnerable Software and Affected Versions: GNUBOARD5 version 5.3.1.9 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the bo mobile content head parameter, also known as the "mobile board head contents" parameter, in the adm/board form update.p...

DEBIAN-CVE-2018-6197

w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c...

PT-2016-7747 · W3M +2 · W3M +2

Name of the Vulnerable Software and Affected Versions: w3m versions prior to 0.5.3-31 Description: An issue in the w3m fork allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted HTML page. This is due to a buffer overflow in the formUpdateBuffer...

CVE-2015-6965

Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...