CVE-2024-6935: medium-severity vulnerability in formtools.org Form Tools
formtools.org Form Tools User Settings Page cross site scripting
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.3%
exploitation probability
0.3%top 77% of all CVEs
observed exploitation
nono source reports it
A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-271990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
formtools.org · Form ToolsRelated CVEs — formtools.org Form Tools
In the same product, most dangerous first.
CVE-2024-6936MEDIUMformtools.org Form Tools Setting code injectionEPSS 0.4%CVE-2024-6934MEDIUMformtools.org Form Tools cross site scriptingEPSS 0.4%CVE-2024-6937MEDIUMformtools.org Form Tools Import Option List edit.php curl_exec file inclusionEPSS 0.4%CVE-2026-103540MEDIUMformtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engineEPSS 0.2%CVE-2026-103542MEDIUMformtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgeryEPSS 0.2%CVE-2026-103541MEDIUMformtools.org Form Tools Ajax actions.php uploadFile unrestricted uploadEPSS 0.2%