Skip to main content

Sureforms CVE-2026-19501

| EUVDEUVD-2026-60962
2026-08-18 certcc GHSA-fwh8-67c4-8cgg
Information Disclosure Sureforms

Lifecycle Timeline

1
CVE Published
Aug 18, 2026 - 15:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

Analysis

CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sureforms

View all
CVE-2026-19500 HIGH POC
7.5 Aug 18

Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submi
CVE-2026-11567 MEDIUM POC
5.9 Jul 14

SureForms WordPress plugin before 2.11.1 permits unauthenticated attackers to submit manipulated payment amounts below t
CVE-2025-3471 MEDIUM POC
4.9 Apr 30

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the

CVE-2025-6691 HIGH
8.1 Jul 09

The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion d
CVE-2025-6742 HIGH
7.5 Jul 09

The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a
CVE-2025-3514 LOW POC
3.5 May 02

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow hi
CVE-2025-3513 LOW POC
3.5 May 02

The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow hi
CVE-2025-5921 MEDIUM
5.8 Aug 01

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the pa
CVE-2024-12713 MEDIUM
5.3 Jan 08

The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in a

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-19501 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy