CVE-2016-9646: Improper Authentication

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder-field method similar to the CGI-param API that led to Bugzilla's CVE-2014-1572, which can be abused to lead to commit metadata forgery...

PT-2018-9246

Name of the Vulnerable Software and Affected Versions: ValidFormBuilder version 4.5.4 Description: The issue concerns a PHP Object Injection vulnerability in the Valid Form unserialize method. This can lead to the execution of unauthorized system commands remotely and the disclosure of file...

FreeBSD : ikiwiki -- multiple vulnerabilities (5ed094a0-0150-11e7-ae1b-002590263bf5)

Mitre reports : ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page...

FormBuilder <= 1.0.7 - Multiple Authenticated SQL Injection

The FormBuilder WordPress plugin was affected by a Multiple Authenticated SQL Injection security vulnerability...

WordPress FormBuilder plugin <= 1.0.8 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by ethicalhack3r in WordPress FormBuilder plugin versions = 1.0.8. Solution Deactivate and delete. This plugin has been closed as of March 2, 2022 and is not available for download. This closure is temporary, pending a full review...

FormBuilder <= 1.0.7 - Cross-Site Request Forgery (CSRF)

The FormBuilder WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WordPress FormBuilder 1.05 Cross Site Request Forgery

------------------------------------------------------------------------ Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification ------------------------------------------------------------------------ Burak Kelebek, July 2016...

PT-2018-5114

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20161229 Description The issue arises from an incorrect call to the CGI::FormBuilder-field method, similar to the CGI-param API issue that led to Bugzilla's vulnerability. This can be exploited to forge commit...

PT-2018-5119

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20170111 Description A flaw exists in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters. Recommendations For versions prior to 3.20170111, updat...

Debian: Security Advisory (DSA-3760-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ikiwiki -- authentication bypass vulnerability

ikiwiki reports: The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact: An attacker who can log in to a site with a password can log in as a different and potentially more privileged user. An...

ikiwiki -- multiple vulnerabilities

Mitre reports: ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page...

WordPress FormBuilder 1.05 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in FormBuilder WordPress Plugin ------------------------------------------------------------------------ Peter Ganzevles, July 2016 -----------------------------------------------------------------------...

FormBuilder <= 1.05 - Authenticated Reflected Cross-Site Scripting (XSS)

The FormBuilder WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

Formbuilder < 0.91 - XSS

The FormBuilder WordPress plugin was affected by a XSS security vulnerability...