GCVE - cpe:2.3:a:formtools:form_tools:3.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:formtools:form_tools:3.1.1:*:*:*:*:*:*:*

part: a version: 3.1.1 update: *

Vendor	Formtools (`ab987411-56f4-529f-b378-57cda8019eb3`)
Product	Form Tools (`b27a3b6e-e8c2-54b7-8ae1-fa4a44160d6e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-6937`	vulnerable	2026-06-08 06:58:20.790714	formtools.org Form Tools Import Option List edit.php curl_exec file inclusion LOW (2.7) A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-07-21T04:00:06.431Z Updated: 2024-08-01T21:45:38.437Z Open on db.gcve.eu Reference links https://vuldb.com/?id.271992 https://vuldb.com/?ctiid.271992 https://vuldb.com/?submit.372602 https://github.com/DeepMountains/Mirage/blob/main/CVE2-3.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6936`	vulnerable	2026-06-08 06:58:20.790049	formtools.org Form Tools Setting code injection LOW (2.7) A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the argument Page Theme leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271991. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-07-21T03:31:03.662Z Updated: 2024-08-01T21:45:38.305Z Open on db.gcve.eu Reference links https://vuldb.com/?id.271991 https://vuldb.com/?ctiid.271991 https://vuldb.com/?submit.372318 https://github.com/DeepMountains/Mirage/blob/main/CVE2-2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6935`	vulnerable	2026-06-08 06:58:20.789368	formtools.org Form Tools User Settings Page cross site scripting LOW (2.4) A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-271990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-07-21T02:00:05.241Z Updated: 2024-08-01T21:45:38.360Z Open on db.gcve.eu Reference links https://vuldb.com/?id.271990 https://vuldb.com/?ctiid.271990 https://vuldb.com/?submit.372317 https://github.com/DeepMountains/Mirage/blob/main/CVE2-1.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6934`	vulnerable	2026-06-08 06:58:20.787814	formtools.org Form Tools cross site scripting LOW (2.4) A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271989 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-07-21T01:31:03.697Z Updated: 2024-08-01T21:45:38.391Z Open on db.gcve.eu Reference links https://vuldb.com/?id.271989 https://vuldb.com/?ctiid.271989 https://vuldb.com/?submit.372309 https://github.com/DeepMountains/Mirage/blob/main/CVE-2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22722`	vulnerable	2026-06-08 06:29:35.996996	Details available Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Published: 2024-04-11T00:00:00.000Z Updated: 2024-08-01T22:51:11.111Z Open on db.gcve.eu Reference links https://hakaisecurity.io/error-404-your-security-not-found-tales-of-web-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22721`	vulnerable	2026-06-08 06:29:35.996523	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22719`	vulnerable	2026-06-08 06:29:35.993680	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22718`	vulnerable	2026-06-08 06:29:35.993229	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22717`	vulnerable	2026-06-08 06:29:35.992742	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22637`	vulnerable	2026-06-08 06:29:35.954706	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.