CVE-2026-103540
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 1, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 30, 2026
Description
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Form Toolsformtools.org |
|
References
- VDB-412350 | formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template enginevdb-entrytechnical-description
- VDB-412350 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-103540 | CVE Analysis and Reportthird-party-advisory
- Submit #957845 | formtools.org / Form Tools project Form Tools Core 3.1.1 Server Side Template Injectionthird-party-advisory
- https://github.com/formtools/core/issues/956issue-tracking
- https://github.com/wawyw/cve_report/blob/main/formtools_1.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.