Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-103540: Form Tools client settings can be exploited remotely
CVE-2026-103540 · published 18 days ago
Summary
Form Tools versions up to 3.1.1 let an attacker send specially crafted data to the client settings feature, which the system fails to clean properly. This could let a remote attacker insert unwanted code into pages served by the application. Update to the latest patched version of Form Tools or apply the vendor's recommended fix as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| formtools.org | form tools | 3.1.0 |
Original advisory text
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://github.com/formtools/core/issues/956
- https://github.com/wawyw/cve_report/blob/main/formtools_1.md
- https://vuldb.com/cve/CVE-2026-103540
- https://vuldb.com/submit/957845
- https://vuldb.com/vuln/412350
- https://vuldb.com/vuln/412350/cti
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-1035... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-103540 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-791Incomplete Filtering of Special Elements
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published1 Oct 2026
Updated14 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta