Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-19501

CVE-2026-19501

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sureforms
Products
Sureforms
CVE-2026-19500

SureForms contains an uncontrolled resource consumption vulnerability

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sureforms
Products
Sureforms
CVE-2026-11567

SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass

The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sureforms Wordpress
Products
Sureforms Wordpress
CVE-2025-8282

SureForms < 1.9.1 - Admin+ Stored XSS

The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sureforms Wordpress
Products
Sureforms Wordpress