Advisories · Technology
heyform.
Every CVE that names heyform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.6 High
HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
- heyform
- Cross-site scripting (XSS)
- CVSS 8.1 High
HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- heyform
- CWE-942
- CVSS 8.6 High
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
- heyform
- Authentication bypass
- Unrestricted file upload
- CVSS 5.8 Medium
HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set
- heyform
- Broken access control
- CWE-20
- CVSS 9.0 CriticalCritical · CVSS 9+
HeyForm vulnerable to stored XSS via form field titles
- heyform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
- heyform
- Cross-site scripting (XSS)
- Unrestricted file upload