Form Tools
Vendor:
First CVE: Dec 20, 2007 · Active for 18 years
11
Total CVEs
More Total CVEs than 88% of tracked products
5.5
Avg CVEs / Year
Higher CVE frequency than 96% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Form Tools over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 20, 2007
18 years ago
Most Recent CVE
Jul 21, 2024
734 days ago
CVE Severity & Scoring
Form Tools11 CVEs
9%
64%
18%
9%
All CVEs352,427 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network10 (90.9%)
Unknown1 (9.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (90.9%)
High0 (0.0%)
Unknown1 (9.1%)
User Interaction
None4 (36.4%)
Unknown1 (9.1%)
Required6 (54.5%)
Privileges Required
Low1 (9.1%)
High5 (45.5%)
None4 (36.4%)
Unknown1 (9.1%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-22718CRITICAL Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL. | Apr 11, 2024 | 9.6 | 29 | NO | NO |
CVE-2007-6464MEDIUM Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in the g_root_dir parameter to (1) admin_page | Dec 20, 2007 | 6.8 | 27 | NO | YES |
CVE-2024-22719HIGH SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. | Apr 11, 2024 | 8.1 | 23 | NO | NO |
CVE-2024-22722HIGH Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the appli | Apr 11, 2024 | 7.2 | 22 | NO | NO |
CVE-2024-22721MEDIUM Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. | Apr 11, 2024 | 6.3 | 19 | NO | NO |
CVE-2024-22717MEDIUM Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application. | Apr 11, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-22637MEDIUM Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2. | Jan 25, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-6936MEDIUM A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index | Jul 21, 2024 | 4.9 | 16 | NO | NO |
CVE-2024-6935MEDIUM A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Set | Jul 21, 2024 | 4.8 | 16 | NO | NO |
CVE-2024-6934MEDIUM A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=dire | Jul 21, 2024 | 4.8 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
9.1% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Form Tools
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.1.1 | 10 | 6.1 | 0.5% | 0 | 0 |
| 1.5.0b | 1 | 6.8 | 2.1% | 0 | 1 |