Form Tools
Monthly
Server-side request forgery in Form Tools through 3.1.1 allows an authenticated low-privileged user to make the server issue arbitrary outbound HTTP requests by supplying a crafted 'url' argument to the smart_fill function in /global/code/actions.php, with no user interaction required. Impact is confined to low confidentiality (probing internal services and cloud metadata endpoints reachable from the host) rather than code execution, so realistic risk is modest and depends heavily on what the server can reach. Publicly available exploit code exists, the flaw is not confirmed as actively exploited (no CISA KEV listing), and no vendor-released patch has been identified at time of analysis.
Unrestricted file upload in Form Tools 3.1.1 and earlier lets an authenticated, low-privileged user push attacker-controlled files onto a self-hosted instance by invoking the Files::uploadFile function in the Ajax Handler (global/code/actions.php). Publicly available exploit code exists, but the attack is access-gated: it requires a reachable Form Tools deployment plus a valid low-privilege session, and practical severity depends on whether uploaded files are written to a web-executable directory. No vendor-released patch is available because the project has not responded to the reported issue, so overall risk is best characterized as low-to-moderate and access-gated rather than urgent.
Server-side template injection (SSTI) in formtools.org Form Tools up to and including version 3.1.1 allows an authenticated low-privilege user to inject template-engine metacharacters via the page_titles argument in Clients::updateClientSettingsTab, potentially causing limited information disclosure and modification within the application. Publicly available exploit code exists, but exploitation requires a valid low-privilege account and the assessed impact is capped at Low for confidentiality, integrity, and availability. The vendor was notified early through a GitHub issue but has not responded, and no patched version has been released.
A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1.php?page=accounts of the component Setting Handler. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Form Tools through 3.1.1 allows an authenticated low-privileged user to make the server issue arbitrary outbound HTTP requests by supplying a crafted 'url' argument to the smart_fill function in /global/code/actions.php, with no user interaction required. Impact is confined to low confidentiality (probing internal services and cloud metadata endpoints reachable from the host) rather than code execution, so realistic risk is modest and depends heavily on what the server can reach. Publicly available exploit code exists, the flaw is not confirmed as actively exploited (no CISA KEV listing), and no vendor-released patch has been identified at time of analysis.
Unrestricted file upload in Form Tools 3.1.1 and earlier lets an authenticated, low-privileged user push attacker-controlled files onto a self-hosted instance by invoking the Files::uploadFile function in the Ajax Handler (global/code/actions.php). Publicly available exploit code exists, but the attack is access-gated: it requires a reachable Form Tools deployment plus a valid low-privilege session, and practical severity depends on whether uploaded files are written to a web-executable directory. No vendor-released patch is available because the project has not responded to the reported issue, so overall risk is best characterized as low-to-moderate and access-gated rather than urgent.
Server-side template injection (SSTI) in formtools.org Form Tools up to and including version 3.1.1 allows an authenticated low-privilege user to inject template-engine metacharacters via the page_titles argument in Clients::updateClientSettingsTab, potentially causing limited information disclosure and modification within the application. Publicly available exploit code exists, but exploitation requires a valid low-privilege account and the assessed impact is capped at Low for confidentiality, integrity, and availability. The vendor was notified early through a GitHub issue but has not responded, and no patched version has been released.
A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1.php?page=accounts of the component Setting Handler. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.