other

Web-to-Lead

Salesforce feature that turns submissions from public web forms into lead records in the CRM.

Known aliases

Salesforce Web-to-Lead
Web-to-Lead forms

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

Planted web-form lead steered Salesforce Agentforce into leaking CRM records to an outside server

Noma Labs disclosed ForcedLeak, a CVSS 9.4 chain that let a planted Salesforce web-form lead steer Agentforce into leaking CRM data. Salesforce blocked the exit on September 8, leaving audits of recent leads and agent activity as the open task.

Publishers:noma.security

Reality

Evidence45
Adoption: Insufficient
Hype gap+35
Incentives75
Confidence50

build1 publisher

SalesBleed made Agentforce leak CRM Account data over DNS from a public lead form

Zenity Labs demonstrated SalesBleed, a proof-of-concept that used a public Salesforce lead form to make Agentforce read Account records and leak them over DNS. Salesforce has already patched it.

Publishers:dev.to

Reality

Evidence45
Adoption: Insufficient
Hype gap+10
Incentives: Insufficient
Confidence55

security2 publishers

Poisoned Web-to-Lead submissions made Salesforce Agentforce leak CRM data past Trusted URLs

Zenity Labs found three Salesforce Agentforce bugs that let a planted sales lead drive zero-click CRM data theft and Slack phishing. Each attack began with one poisoned lead-form submission, and Salesforce fixed all three within 79 days of Zenity's report.

Publishers:infosecurity-magazine.comsecurityweek.com

Reality

Evidence58
Adoption: Insufficient
Hype gap+15
Incentives40
Confidence62