Heyform vulnerabilities
Products
- Heyform 6
Newest
- heyform HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS 7.6 High
- heyform HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials 8.1 High
- heyform HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context 8.6 High
- heyform HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set 5.8 Medium
- heyform HeyForm vulnerable to stored XSS via form field titles 9.0 Critical
- heyform HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload 6.4 Medium