CVE-2026-73130 Gitea repository initialization resource exhaustion

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

CVE-2026-73130 Gitea repository initialization resource exhaustion

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

CVE-2026-86799

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any...

CVE-2026-106166

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-86799

The Forms WordPress plugin (versions before 3.0.2 ) is vulnerable to unauthenticated stored XSS via form submission. The application fails to sanitise submitted form values upon storage and fails to escape those values before they are rendered on the form submissions screen in the administration ...

EUVD-2026-100855

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any...

CVE-2026-86799 Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any...

CVE-2026-106166

The NEX-Forms WordPress plugin versions before 9.3.1 is vulnerable to unauthenticated arbitrary form entry modification. The flaw exists because the plugin fails to perform authorization, ownership, or request-validation checks before updating stored entries. An unauthenticated attacker can use t...

EUVD-2026-100883

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

WordPress NEX-Forms plugin 9.2.1-9.3.0 - Unauthenticated Arbitrary Form Entry Modification vulnerability

Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Farid Narimanov in WordPress Plugin NEX-Forms versions 9.2.1-9.3.0...

Xenotix-xBOT

Xenotix-xBOT Xenotix xBOT is a proof of concept cross platform Linux, Windows, Mac bot written in Python that abuse certain Google Services to implement Command & Control Center for the botnet. The Google Apps Data API, Google Forms and Google Spreadsheet is abused to implement C2 for a bot...

CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Adobe AEM Forms on JEE OGNL Injection to RCE 🔎 Overview CVE-2025-54253 is a critical OGNL injection vulnerability in Adobe AEM Forms on JEE. It allows unauthenticated attackers to execute arbitrary operating system commands via the /adminui/debug?debug=OGNL: endpoint. Severity:...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — Vulnerable Docker Lab Reproducible Docker lab for CVE-2017-20192 Formidable Forms 2.05.03 stored XSS. Quickstart docker compose up -d --build Target: http://127.0.0.1:18080 Validate lab helper This helper script: submits a crafted entry unauthenticate...

CVE-2026-95816

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-95816

The Smart Forms WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.6.104 . The flaw exists in the 'formString' parameter due to insufficient input sanitization and output escaping. Because the nonce check for the rednao_smart_forms_save_form_...

EUVD-2026-100794

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for...

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Caldera Forms WordPress plugin 1.9.7 contains a reflected cross-site scripting caused by lack of validation and escaping of the cf-api parameter in responses, letting attackers execute arbitrary scripts in victim's browser, exploit requires attacker to craft a malicious request. id: CVE-2022-0879...

Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...