CyberRota Analysis
AI-GeneratedA stored cross-site scripting (XSS) vulnerability in HeyForm prior to version 3.0.0-rc.7 allows low-privileged team members to inject malicious JavaScript into forms, which executes when viewed by team owners, potentially leading to complete account takeover through privilege escalation. Organizations using affected versions of the Java-based form builder should prioritize updating to the patched version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.