Web-to-Lead
A standard feature of CRM platforms that automatically converts public website form submissions into lead records in the CRM, allowing data to be written without authentication.
Timeline (last 90 days)
The entry point of the SalesBleed attack is the Web-to-Lead form; attackers embed prompt injection in form fields, and after the Agent reads the contaminated record it obtains other CRM data and exfiltrates it via image tags.
Web-to-Lead is a standard feature provided by CRM platforms such as Salesforce: after a contact form on a website is submitted, a lead record is automatically created in the CRM, with no authentication required, so any visitor can write data.
All Facts (2)
Web-to-Lead is a standard feature provided by CRM platforms such as Salesforce: after a contact form on a website is submitted, a lead record is automatically created in the CRM, with no authentication required, so any visitor can write data.
50%UnverifiedThe entry point of the SalesBleed attack is the Web-to-Lead form; attackers embed prompt injection in form fields, and after the Agent reads the contaminated record it obtains other CRM data and exfiltrates it via image tags.
50%