MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

MAL-2026-12367 Malicious code in dolyame-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5714ca0e12469cd96b5fef550b4f9715da5b806e8bd365ecfbea757c3f05f73e On require of the package, index.js loads bootstrap.js inside a swallowed try/catch. bootstrap.js selects a per-OS/arch payload path and downloads...

Malicious code in dolyame-boxy-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19 On require of the package's main, index.js side-loads runtime.js which selects a per-platform payload path, fetches an opaque binary from string-spli...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

EUVD-2026-53322

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...

MAL-2026-12223 Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12145 Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-16573

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

EUVD-2026-53176

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...