CVE-2024-6934: medium-severity vulnerability in formtools.org Form Tools
formtools.org Form Tools cross site scripting
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271989 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
formtools.org · Form ToolsRelated CVEs — formtools.org Form Tools
In the same product, most dangerous first.
CVE-2024-6936MEDIUMformtools.org Form Tools Setting code injectionEPSS 0.4%CVE-2024-6937MEDIUMformtools.org Form Tools Import Option List edit.php curl_exec file inclusionEPSS 0.4%CVE-2024-6935MEDIUMformtools.org Form Tools User Settings Page cross site scriptingEPSS 0.3%CVE-2026-103540MEDIUMformtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engineEPSS 0.2%CVE-2026-103542MEDIUMformtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgeryEPSS 0.2%CVE-2026-103541MEDIUMformtools.org Form Tools Ajax actions.php uploadFile unrestricted uploadEPSS 0.2%