Formtools
Formtools Form Tools: vulnerabilities and CVEs
Formtools Form Tools has 13 published vulnerabilities, 3 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs13
Last 12 months3
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-103542 | Low (2.1) | — | — | Oct 1, 2026 | A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes… |
| CVE-2026-103541 | Low (2.1) | — | — | Oct 1, 2026 | A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in… |
| CVE-2026-103540 | Low (2.1) | — | — | Oct 1, 2026 | A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component… |
| CVE-2024-6937 | Medium (5.1) | 0.37% | — | Jul 21, 2024 | A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List.… |
| CVE-2024-6936 | Medium (5.1) | 0.40% | — | Jul 21, 2024 | A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component… |
| CVE-2024-6935 | Medium (5.1) | 0.32% | — | Jul 21, 2024 | A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to… |
| CVE-2024-6934 | Medium (5.1) | 0.39% | — | Jul 21, 2024 | A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument… |
| CVE-2024-22722 | High (7.2) | 0.89% | — | Apr 11, 2024 | Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. |
| CVE-2024-22721 | Medium (6.3) | 0.19% | — | Apr 11, 2024 | Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. |
| CVE-2024-22719 | High (8.1) | 0.54% | — | Apr 11, 2024 | SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. |
| CVE-2024-22718 | Critical (9.6) | 0.66% | — | Apr 11, 2024 | Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL. |
| CVE-2024-22717 | Medium (6.1) | 0.37% | — | Apr 11, 2024 | Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application. |
| CVE-2024-22637 | Medium (6.1) | 0.45% | — | Jan 25, 2024 | Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2. |