Vulnerabilities in heyform

5 results

Vexday analysis

Heyform apresenta 4 vulnerabilidades conhecidas, todas publicadas recentemente (últimos 90 dias), com 1 classificada como crítica; nenhuma está sob exploração ativa documentada. A fraqueza dominante é upload de arquivo não validado (CWE-434), representando o vetor de risco primário na plataforma.

CVE-2026-45797MEDIUMHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File UploadEPSS 0.6%CVE-2026-63429HIGHHeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form contextEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2026-82291HIGHHeyForm Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.3%