Search Vulnerabilities

HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

rConfig Core < 8.2.8 Privilege Escalation via Users API role field

9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion

FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use

Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override