9950 matches found
cve-2026-67363-67364
Balbooa Forms RCE pre-autenticación + Manipulación de Pagos CVE-2026-67364 / CVE-2026-67363 PoC y plantillas de detección para dos vulnerabilidades pre-autenticación en Balbooa Forms combaforms para Joomla, corregidas en 2.4.3.2. CVE-2026-67364 — Inyección de Código PHP pre-autenticación - RCE CV...
CVE-2026-3584
CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - Ejecución Remota de Código No Autenticado a través de formprocess 🔥 Resumen de la Vulnerabilidad El plugin de WordPress Kali Forms versiones = 2.4.9 presenta una vulnerabilidad crítica de ejecución remota de código no autenticado RCE. Esta falla...
CVE-2026-87068
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...
CVE-2026-87067
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
EUVD-2026-83670
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...
CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
EUVD-2026-83671
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...
CVE-2026-87068
Forminator Forms for WordPress (before 1.57.2.1 ) contains an authenticated privilege escalation vulnerability. When a registration form is nested inside an imported quiz, the plugin fails to enforce the role validation it applies elsewhere. This allows a user with quiz-import capability to publi...
CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...
CVE-2026-87067
CVE-2026-87067 affects the Forminator Forms WordPress plugin in versions before 1.57.2.1 . The plugin fails to restrict which classes may be instantiated when it deserialises a value received from an XML-RPC request , enabling a PHP object injection attack. An attacker holding the plugin's forms-...
drupal-cve-2018-7600-poc
Drupal Drupalgeddon 2 未授权远程代码执行漏洞（CVE-2018-7600） Drupal是一个使用PHP编写的免费开源的Web内容管理框架。 在Drupal 7.58之前的版本、8.3.9之前的8.x版本、8.4.6之前的8.4.x版本和8.5.1之前的8.5.x版本中存在远程代码执行漏洞。该漏洞影响了多个具有默认或常见模块配置的子系统，包括Form API。 参考链接： https://www.drupal.org/sa-core-2018-002 https://research.checkpoint.com/uncovering-drupalgeddon-2/...
CVE-2026-87068: Improper Privilege Management
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...
CVE-2026-87067: Improper Control of Generation of Code
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
Exploit for CVE-2026-84434
CVE-2026-84434 — Gravity Forms Unauthenticated Arbitrary File...
cve-2026-32475-elementor-pro-lab
CVE-2026-32475 — Elementor Pro Forms carga de archivos arbitraria sin autenticación → RCE Laboratorio A/B en Docker que reproduce CVE-2026-32475 CVSS 9.x, Patchstack; campo de carga de archivos de Elementor Pro Forms, afectado ≤ 4.2.1, corregido en 4.2.2 el 2026-08-19; reportado por Tin Pham /...
CVE-2026-15664
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-15664
Quill Forms (Conversational Multi Step Forms, Surveys & Quizzes) for WordPress is affected by a stored cross-site scripting vulnerability in all versions up to and including 5.7.1 . The flaw stems from insufficient input sanitization and output escaping in the Multiple Choice "Other" field . An u...
EUVD-2026-83574
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...