33180 matches found
CVE-2026-77078
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...
CVE-2026-77063
multer , a Node.js middleware for handling multipart/form-data, contains a race condition in its file stream handling that is triggered when an application uses an asynchronous fileFilter together with the fileSize limit . An attacker can exploit this to cause a file that exceeds the configured s...
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by CoryRoo in WordPress Plugin Hash Form versions = 1.4.2...
WordPress Customer Reviews for WooCommerce plugin <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability
Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability discovered by daroo in WordPress Plugin Customer Reviews for WooCommerce versions = 5.106.0...
WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability
Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...
CVE-2026-82260
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...
CVE-2026-82261
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82256
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...
CVE-2026-82257
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...
CVE-2026-82259
SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...
EUVD-2026-67711
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...
CVE-2026-6176
The Customer Reviews for WooCommerce WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 5.106.0 . The root cause is insufficient input sanitization and output escaping: review comment text submitted via the cr_local_forms_submit AJAX acti...
CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82261
SvelteKit (@sveltejs/kit) versions >=2.49.0 and
CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
EUVD-2026-67587
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82261
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...
CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions experimental.remoteFunctions and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process an...
CVE-2026-82260
SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 with the experimental remoteFunctions and form features enabled are vulnerable to memory exhaustion in remote form deserialization. Malformed form data triggers excessive memory allocation, crashing the server process and causing a denial o...