CVE-2024-6934: falha de média gravidade em formtools.org Form Tools
formtools.org Form Tools cross site scripting
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.4%
probabilidade de exploração
0.4%top 68% das CVEs
exploração observada
nãonenhuma fonte reporta
A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271989 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
formtools.org · Form ToolsCVEs relacionadas — formtools.org Form Tools
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6936MEDIUMformtools.org Form Tools Setting code injectionEPSS 0.4%CVE-2024-6937MEDIUMformtools.org Form Tools Import Option List edit.php curl_exec file inclusionEPSS 0.4%CVE-2024-6935MEDIUMformtools.org Form Tools User Settings Page cross site scriptingEPSS 0.3%CVE-2026-103540MEDIUMformtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engineEPSS 0.2%CVE-2026-103542MEDIUMformtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgeryEPSS 0.2%CVE-2026-103541MEDIUMformtools.org Form Tools Ajax actions.php uploadFile unrestricted uploadEPSS 0.2%