Major Description
An attacker can easily bypass form validation by setting the hidden field "bypass_validation" to true. A call to form.isValid() returns true though the validators have not been run. If the software relies on the form validators, its easy to get "evil" data in the application.