33325 matches found
PT-2026-71990
Name of the Vulnerable Software and Affected Versions Grav Form plugin versions prior to 9.1.15 Description A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig |raw filter. This allows attackers with form authoring permissions to injec...
CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-13051
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...
CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
EUVD-2026-58156
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-58428
The Git repository management system Gitea is vulnerable to an attachment extension allowlist bypass via the web release edit form. An authenticated remote attacker with repository write permissions can exploit flaws in the EditReleasePost() function (in routers/web/repo/release.go) and the Updat...
CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...
CVE-2026-13051
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...
CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...
CVE-2022-4993
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
Frappe Web Form script context values rendered unescaped, leading to XSS
Frappe Web Form Script Context Values Rendered Unescaped, Leading to Stored XSS Vulnerability Overview Web Form in Frappe Framework website forms is a data-submission entry point for anonymous/external users; its page template serializes the server-side document object and injects it into a globa...
CVE-2026-66660
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-28184
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-66660
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
EUVD-2026-57898
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...