Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

64 results · page 1 of 2

Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96398 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing.CVE-2026-96391 · Websites & servers · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96373 · Websites & servers · reported by mlhess@drupal.orgLow 3.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96372 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96371 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery.CVE-2026-96370 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security LevelCVE-2026-96369 · Websites & servers · reported by mlhess@drupal.orgLow 3.1
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96368 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96367 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96366 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation.CVE-2026-96365 · Websites & servers · reported by mlhess@drupal.orgHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse.CVE-2026-96364 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96363 · Websites & servers · reported by mlhess@drupal.org
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).CVE-2026-96362 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).CVE-2026-96361 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).CVE-2026-96360 · Websites & servers · reported by mlhess@drupal.orgLow 3.5
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).CVE-2026-96359 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).CVE-2026-96358 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96357 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.CVE-2026-96356 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection.CVE-2026-96355 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing.CVE-2026-84921 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Aug 25, 2026Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing.CVE-2026-16644 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Apr 8, 2026Mailercloud – Integrate webforms and synchronize website contacts: Missing AuthorizationCVE-2026-39713 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
Product
Mailercloud – Integrate webforms and synchronize website contacts
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Mailercloud – Integrate webforms and synchronize website contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 25, 2025Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer.CVE-2025-12848 · Websites & servers · reported by mlhess@drupal.orgHigh 7
Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is present in a third-party library and has been addressed in a patch available at https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record d7es.tag1.com d7security.org
Mar 11, 2025amoCRM WebForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.
Product
amoCRM WebForm
Affected
up to 1.1
What to do
Affects up to 1.1. Update amoCRM WebForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2020The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page.CVE-2019-25012 · Other software · Webform Report Project · reported by MITREHigh 7.5
The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy.
Product
Webform Report
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Jun 29, 2020XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.CVE-2020-12635 · Other software · Mageme · reported by MITREMedium 6.1
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.
Product
Webforms Pro M2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anothernetsecblog.com mageme.com
Apr 14, 2020SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacCVE-2020-6219 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.
Product
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 12, 2019Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.CVE-2019-18925 · Other software · Systematic · reported by MITRECritical 9.8
Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.
Product
Iris Webforms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 12, 2019Systematic IRIS WebForms 5.4 is vulnerable to directory traversal.CVE-2019-18924 · Other software · Systematic · reported by MITREMedium 5.3
Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations), it is possible to list all the directories and check if a particular file exists.
Product
Iris Webforms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 10, 2019The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials whicCVE-2019-0285 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.8
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
Product
SAP Crystal Reports for Visual Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com launchpad.support.sap.com
Jul 5, 2018In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.CVE-2017-11175 · Other software · Siemens · reported by MITREMedium 6.1
In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login.
Product
FIN Stack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 15, 2018Cross-site scripting (XSS) vulnerability in the Webform Framework API in IBM Forms Server 4.0.x, 8.0.x, 8.1, and 8.2 allows remote attackers to inject arbitraryCVE-2016-0223 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
Cross-site scripting (XSS) vulnerability in the Webform Framework API in IBM Forms Server 4.0.x, 8.0.x, 8.1, and 8.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110006.
Product
Forms Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com
May 22, 2017Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2CVE-2017-9140 · Other software · Progress · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
Product
Telerik Reporting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record telerik.com knowledgebase.progress.com
Aug 18, 2015Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certaiCVE-2015-5494 · Other software · Webform Matrix Component Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Product
Webform Matrix Component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com drupal.org
Jun 16, 2015Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote autCVE-2015-4374 · Other software · Webform Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.
Product
Webform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jun 15, 2015Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remoCVE-2015-4384 · Other software · Ubercart Webform Checkout Pane Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Product
Ubercart Webform Checkout Pane
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jun 15, 2015Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows rCVE-2015-4379 · Other software · Webform Multiple File Upload Project · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.
Product
Webform Multiple File Upload
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jun 15, 2015Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote autCVE-2015-4357 · Other software · Webform Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a webform block.
Product
Webform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jun 15, 2015Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticCVE-2015-4356 · Other software · Webform Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
Product
Webform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jun 15, 2015Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticatedCVE-2015-4354 · Other software · Ubercart Webform Integration Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Product
Ubercart Webform Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Feb 17, 2015Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitraryCVE-2015-1621 · Other software · Webform Prepopulate Block Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Product
Webform Prepopulate Block
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com drupal.org
Jan 9, 2015Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticatCVE-2014-9498 · Other software · Webform Invitation Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web script or HTML via a node title.
Product
Webform Invitation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Nov 20, 2014The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction andCVE-2014-9022 · Other software · Web Component Roles Project · reported by MITREMedium 6.4
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form.
Product
Web Component Roles
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Oct 26, 2014SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the user_id parameter to plugins/webformCVE-2014-5520 · Other software · Xrms CRM Project · reported by MITREHigh 7.5
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the user_id parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php.
Product
Xrms CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Oct 25, 2014The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payCVE-2013-4594 · Other software · Payment For Webform Project · reported by Red HatMedium 4.3
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.
Product
Payment For Webform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org secunia.com
Oct 17, 2014Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allCVE-2014-8318 · Other software · Webform Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields have the same form_key.
Product
Webform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 17, 2014Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticatCVE-2014-8317 · Other software · Webform Validation Project · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text.
Product
Webform Validation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 6, 2014Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x befCVE-2014-2575 · Other software · Devexpress · reported by MITREMedium 6.5
Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. (dot dot) in the __EVENTARGUMENT parameter.
Product
Aspxfilemanager Control For Webforms And MVC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.