CVE-2026-118067

Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.51

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the wdform <field id> element<form id> and disabled fields<form id> parameters. The attack requires the targeted form to include a File Upload field; the attacker uses the disabled fields parameter to suppress the storage row of that field, shifting a controlled text-field value into a position where escaping is skipped. The injected script executes when an administrator accesses the Submissions page for the affected form.

Recommendations Update to a version newer than 1.15.50.