Forms
Monthly
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Unauthenticated remote code execution in the Balbooa Forms extension for Joomla (versions before 2.4.3.4) lets a visitor submit a crafted public form that results in attacker-controlled PHP being evaluated server-side. The root cause is that the extension substitutes form-field shortcodes with the raw value submitted by the visitor before passing administrator-defined 'PHP after submission' code to eval(), allowing a value to break out of a double-quoted PHP string. Exploitation is conditional, not blanket: it requires an administrator to have enabled the optional PHP-after-submission action and to have interpolated an attacker-controllable field shortcode inside a double-quoted string, a non-default configuration reflected as AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CPE string was supplied; the vendor scores this 9.5 (critical) whereas our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Unauthenticated remote attackers can tamper with uploaded file metadata in Balbooa Forms for Joomla versions before 2.4.3.4 by exploiting insufficient validation of client-supplied filenames and display names during the final form submission. This allows cross-session file claiming and potential path traversal via the getFilePath() function, though the impact is limited to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified, and the CVSS 4.0 score of 6.9 overstates the real-world risk per independent assessment.
Unauthenticated guests can delete other users' temporary file attachments on Joomla sites running the Balbooa Forms extension below version 2.4.3.4. The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file; the controller does verify a Joomla session token, but the model never ties that ID to the uploading session, user, form, upload field, or temporary state, so any guest can obtain a token for their own session and then destroy arbitrary pending uploads by enumerating valid integer IDs. Impact is confined to integrity of temporary/pending attachment records and files (CVSS 3.1 C:N/I:L/A:N, no confidentiality or availability effect), and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with HTTP access to Oracle Forms Services can read a limited subset of data the application exposes, per Oracle's Fusion Middleware security advisory affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), meaning low-complexity, no-credential, no-user-interaction exploitation whose only impact is partial confidentiality loss - there is no integrity or availability impact and no scope change. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so this should be treated as a patch-now confidentiality leak rather than an actively exploited emergency.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Forms Services, C/S and Charmode components that lets a high-privileged attacker with network access over HTTP tamper with or destroy critical Forms data and repeatedly crash the service (complete denial of service). Oracle rated it 6.5 with integrity and availability impacts only, meaning confidentiality is untouched but data can be created, deleted or modified. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.