Advisories · Technology
brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder.
Every CVE that names brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- CWE-20
- CVSS 7.2 High
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Information disclosure
- CVSS 4.3 Medium
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Broken access control
- CVSS 4.3 Medium
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Broken access control
- CVSS 5.3 Medium
SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure
- brainstormforce SureForms – Contact Form, Payment Form & Other Custom Form Builder
- Broken access control