CVE-2024-22722

A Server Side Template Injection (SSTI) vulnerability exists in Form Tools version 3.1.1 . This flaw allows attackers to execute arbitrary commands by exploiting the Group Name field within the application's add forms section. Publicly available proof-of-concept scripts, such as those found on Gi...

CVE-2024-22718

A Cross Site Scripting (XSS) vulnerability exists in Form Tools version 3.1.1 . The issue is caused by improper neutralization of input within the client_id parameter in the application URL, which allows attackers to run arbitrary code on the client-side. As a temporary workaround, it is recommen...

CVE-2024-22721

A Cross-Site Request Forgery (CSRF) vulnerability exists in Form Tools version 3.1.1 , an open-source codebase for form tool scripts, modules, themes, and APIs. This flaw allows an attacker to manipulate sensitive user data by tricking a victim into clicking a crafted link . The impact includes u...

CVE-2024-6936

Form Tools 3.1.1 has a vulnerability in the Setting Handler (file /admin/settings/index.php?page=accounts) where manipulating the Page Theme parameter leads to code injection. The issue can be exploited remotely, and public exploit information exists. Documents do not provide an official patched ...

CVE-2024-6937

Form Tools 3.1.1 is affected in the Import Option List component, specifically the curl_exec function in /admin/forms/option_lists/edit.php. The vulnerability arises from manipulation of the url argument, causing file inclusion and enabling a remote attack. Public disclosure is noted. Remediation...

CVE-2024-22637

CVE-2024-22637 refers to a reflected cross-site scripting (XSS) vulnerability in Form Tools v3.1.1, exploitable via the endpoint /form_builder/preview.php?form_id=2. Root cause: insufficient validation/sanitization in the preview component that processes the form_id parameter, enabling injection ...

CVE-2024-22719

An SQL Injection vulnerability exists in Form Tools version 3.1.1 . The flaw originates from the improper neutralization of special elements in the 'keyword' parameter used when searching for a client. This allows an attacker to execute arbitrary SQL commands by manipulating the search functional...

CVE-2024-6935

Form Tools 3.1.1 is affected by a cross-site scripting vulnerability in the User Settings Page, specifically the /admin/clients/ file. The issue is triggered remotely and has publicly disclosed exploit details. Affected component/URL: /admin/clients/ within Form Tools 3.1.1. Root cause and exact ...

CVE-2024-22717

The Form Tools application, version 3.1.1 , is susceptible to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input in the First Name field, which allows attackers to execute arbitrary malicious scripts on the client-side. This could lead to unauthoriz...

CVE-2024-6934

CVE-2024-6934 affects Form Tools 3.1.1 (Form Tools) with a cross-site scripting flaw in /admin/forms/add/step2.php?submission_type=direct caused by manipulation of the Form URL. Exploitation is possible remotely; multiple sources and PT Security confirm the vulnerability and note no known fix for...