{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T21:48:04.580","vulnerabilities":[{"cve":{"id":"CVE-2017-16015","sourceIdentifier":"support@hackerone.com","published":"2018-06-04T19:29:00.977","lastModified":"2026-06-17T01:08:38.687","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting"},{"lang":"es","value":"Forms es una biblioteca para crear formularios HTML fácilmente. Las versiones anteriores a la 1.3.0 no contaban con un escapado HTML adecuado. Esto significa que, si la aplicación no saneaba código html en representación de los formularios, su uso podría ser vulnerable a Cross-Site Scripting (XSS)."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"forms node module","versions":[{"version":"<1.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:forms_project:forms:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.3.0","matchCriteriaId":"10A11156-1800-4EDD-9645-CB77601B5257"}]}]}],"references":[{"url":"https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d","source":"support@hackerone.com","tags":["Patch"]},{"url":"https://nodesecurity.io/advisories/158","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://nodesecurity.io/advisories/158","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}