CVE-2019-10866

In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.

• CWE-89

• http://seclists.org/fulldisclosure/2019/May/8Exploit, Mailing List, Third Party Advisory
• https://wordpress.org/plugins/form-maker/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9286
• http://seclists.org/fulldisclosure/2019/May/8Exploit, Mailing List, Third Party Advisory
• https://wordpress.org/plugins/form-maker/#developersRelease Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9286

Published

May 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10854Computrols CBAS 18.0.0 allows Authenticated Command Injectio…
• CVE-2019-10855Computrols CBAS 18.0.0 mishandles password hashes. The appro…
• CVE-2019-10856In Jupyter Notebook before 5.7.8, an open redirect can occur…
• CVE-2019-1086An elevation of privilege exists in Windows Audio Service, a…
• CVE-2019-10863A command injection vulnerability exists in TeemIp versions …
• CVE-2019-10864The WP Statistics plugin through 12.6.2 for WordPress has XS…
• CVE-2019-10867An issue was discovered in Pimcore before 5.7.1. An attacker…
• CVE-2019-10868In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21…6.5
• CVE-2019-10869Path Traversal and Unrestricted File Upload exists in the Ni…8.1
• CVE-2019-1087An elevation of privilege exists in Windows Audio Service, a…
• CVE-2019-10871An issue was discovered in Poppler 0.74.0. There is a heap-b…
• CVE-2019-10872An issue was discovered in Poppler 0.74.0. There is a heap-b…