Formtools

13 CVEs across 2 Formtools products. Browse Formtools vulnerabilities, severities, and proof-of-concept exploits.

Formtools products with known CVEs

ProductCVEs
Form Tools10
Core3
Formtools CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-6937Low2.72024-07-21A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/…
CVE-2024-6936Low2.72024-07-21A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file…
CVE-2024-6935Low2.42024-07-21A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of t…
CVE-2024-6934Low2.42024-07-21A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php…
CVE-2024-22722High7.22024-04-11Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms…
CVE-2024-22721Medium6.32024-04-11Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.
CVE-2024-22719High8.12024-04-11SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client.
CVE-2024-22718Critical9.62024-04-11Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL.
CVE-2024-22717Medium6.12024-04-11Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application.
CVE-2024-22637Medium6.12024-01-25Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2.
CVE-2021-38145Critical9.82021-08-31An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export…
CVE-2021-38144Medium5.42021-08-31An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e…
CVE-2021-38143Medium6.12021-08-31An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed w…