Have to deal with some incorrectly assigned/redirected posts from an HTTPS server to HTTP URL's. How much of a security risk are these? Are they vulnerable to something like a man-in-the-middle attack?
<form action="http://example.com/"> would post data insecurely, even if the page the
<form> is on is itself HTTPS. Data sent in this manner can be intercepted / MITMed.
For the same reasons,
<form action="https://example.com/"> on a HTTP page is sent securely. However, the page the
action that could send the data elsewhere.
If you're working with sensitive data, both the page with the form and the form action need to be HTTPS.