CVE-2016-10215

An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

• CWE-79

• https://github.com/Fastspot/bigtree-form-builder/commit/06fde0cc67ff121b212715031e12574f50970fcdRelease Notes, Third Party Advisory
• https://github.com/Fastspot/bigtree-form-builder/commit/06fde0cc67ff121b212715031e12574f50970fcdRelease Notes, Third Party Advisory

Published

Feb 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1021Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10210libyara/lexer.l in YARA 3.5.0 allows remote attackers to cau…
• CVE-2016-10211libyara/grammar.y in YARA 3.5.0 allows remote attackers to c…
• CVE-2016-10212Radware devices use the same value for the first two GCM non…
• CVE-2016-10213A10 AX1030 and possibly other devices with software before 2…
• CVE-2016-10214Memory leak in the virgl_resource_attach_backing function in…
• CVE-2016-10216An issue was discovered in IT ITems DataBase (ITDB) through …
• CVE-2016-10217The pdf14_open function in base/gdevp14.c in Artifex Softwar…
• CVE-2016-10218The pdf14_pop_transparency_group function in base/gdevp14.c …
• CVE-2016-10219The intersect function in base/gxfill.c in Artifex Software,…
• CVE-2016-1022Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10220The gs_makewordimagedevice function in base/gsdevmem.c in Ar…