{"id":"CVE-2026-19500","aliases":["EUVD-2026-60968","GHSA-xc26-q9g5-f99x"],"status":"published","title":"SureForms contains an uncontrolled resource consumption vulnerability","description":"The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00582,"percentile":0.48239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-400"],"published":"2026-08-18T15:21:59Z","modified":"2026-09-03T17:45:20Z","exploits":[{"source":"pocgithub","id":"typedefabcd1234ntd/CVE-2026-19500-poc","title":"typedefabcd1234ntd/CVE-2026-19500-poc","date":"2026-08-18","url":"https://github.com/typedefabcd1234ntd/CVE-2026-19500-poc"}],"products":[{"vendor":"sureforms","product":"sureforms"},{"vendor":"unknown","product":"sureforms"}],"references":[{"url":"https://sureforms.com/"},{"url":"https://github.com/typedefabcd1234ntd/CVE-2026-19500-poc","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19500"},{"url":"https://sureforms.com"},{"url":"https://github.com/advisories/GHSA-xc26-q9g5-f99x"}],"sources":{"cve":[{"id":"CVE-2026-19500","title":"SureForms contains an uncontrolled resource consumption vulnerability","description":"The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.","status":"published","published":"2026-08-18T15:21:59.278Z","modified":"2026-08-19T13:41:18.259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-60968","description":"The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.","status":"published","published":"2026-08-18T15:21:59Z","modified":"2026-08-19T13:41:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:45.260244Z"}],"ghsa":[{"id":"GHSA-xc26-q9g5-f99x","title":"The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce...","description":"The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.","status":"published","published":"2026-08-18T18:31:58Z","modified":"2026-08-18T18:32:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:10:37.069016Z"}],"nvd":[{"id":"CVE-2026-19500","description":"The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.","status":"published","published":"2026-08-18T16:17:02.647Z","modified":"2026-09-03T17:45:20.84Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:38.976695Z"}]}}