Skip to content
OpenAdvisories

Product · apostrophecms

form

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-113667

    ApostropheCMS: CAPTCHA response token not URL-encoded

    ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provid…

    apostrophecms apostrophe form login-recaptcha npm
  • Medium 5.3
    CVE-2026-113656

    ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

    ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate li…

    apostrophecms apostrophe form @apostrophecms/form npm