CVE-2026-35198criticalCWE-79

CVE-2026-35198: fallo crítico en heyform

HeyForm vulnerable to stored XSS via form field titles

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear heyform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9epss 0.5%
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
heyform · heyform
CVEs relacionadas — heyform

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-45797MEDIUMHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File UploadEPSS 0.6%CVE-2026-82291HIGHHeyForm Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.6%CVE-2026-63429HIGHHeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form contextEPSS 0.5%CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2026-102615HIGHHeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSSEPSS —