CVE search

402 292 vulnerabilities · 1 766 actively exploited (CISA KEV)

8 results

ID	Severity	Summary	Published
CVE-2026-15305	MOYENNE6.3	Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting	14/07/2026
CVE-2026-49741	ÉLEVÉE8.7	Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors ori	09/06/2026
CVE-2026-47346	ÉLEVÉE7.6	Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by cre