ROOT-APP-NPM-CVE-2026-12143 CVE-2026-12143 in form-data - Patched by Root

Root has patched CVE-2026-12143 in the form-data package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-7783 CVE-2025-7783 in form-data - Patched by Root

Root has patched CVE-2025-7783 in the form-data package for Root:npm. Multiple fixed versions available...

MINI-CF7V-M64R-GPR2

Bulletin has no description...

CVE-2026-19481

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

CVE-2026-48771

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance

Summary The form-data package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-12143 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the fie...

CVE-2026-14206 HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-19355

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

EUVD-2026-54924

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-19356

MingSoft MCMS (up to 3.0.6) is affected in the ms-mdiy component, specifically via an issue in the /mdiy/form/data/list path. The vulnerability enables information disclosure and is exploitable remotely. Public exploits are noted in the sources. The vendor was contacted about the disclosure but d...

CVE-2026-19355 MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19355

Affected software: MingSoft MCMS up to version 3.0.6, specifically the ms-mdiy component. Vulnerable surface: the function ModelDataImpl.queryDiyFormData in /mdiy/form/data/list.do can be triggered by manipulating the argument formFields, leading to SQL injection. Impact: remote attacker could po...

CVE-2026-16267

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.4.0 Patch 4 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

EUVD-2026-54442

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

CVE-2026-54211 TeamDavid: Buffer Overflow in multiple form data parameters

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

CVE-2026-54211

CVE-2026-54211 affects Tobit Laboratories AG TeamDavid's Webbox: endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values can crash the server, causing denial of service. Depending on stack state or if a stack canary i...

Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS

The version of the axios Node.js module installed on the remote host is 0.28.0 prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - Uncontrolled recursion in formDataToJSON when an application passes attacker-controlled FormData field names with...

io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...