Description
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper neutralization of special elements in template processing
Action: Apply Patch
AI Analysis

Impact

The flaw is present in formtools.org Form Tools up to version 3.1.1, specifically in the Clients::updateClientSettingsTab method of Clients.class.php. Manipulating the page_titles argument causes the template engine to fail to neutralize special elements, which can result in arbitrary strings being inserted into rendered output. This flaw allows malicious content to be displayed to users who view the affected pages.

Affected Systems

The vulnerability affects formtools.org Form Tools releases 3.1.1 and earlier. No newer releases have been documented as fixing the issue.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw from a remote location by sending crafted input to the updateClientSettingsTab endpoint; the malicious payload is then embedded in the page output.

Generated by OpenCVE AI on October 1, 2026 at 08:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version of formtools.org Form Tools newer than 3.1.1 where the template neutralization has been corrected.
  • If an upgrade is not possible, sanitize or escape the page_titles input before it reaches the template engine to remove or neutralize template syntax.
  • Deploy web application firewall rules to block requests to the Clients::updateClientSettingsTab endpoint that contain known template injection patterns.

Generated by OpenCVE AI on October 1, 2026 at 08:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Formtools
Formtools form Tools
Vendors & Products Formtools
Formtools form Tools

Thu, 01 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
First Time appeared Form Tools
Form Tools form Tools
Weaknesses CWE-1336
CWE-791
CPEs cpe:2.3:a:form_tools:form_tools:*:*:*:*:*:*:*:*
Vendors & Products Form Tools
Form Tools form Tools
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Form Tools Form Tools
Formtools Form Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T19:10:09.527Z

Reserved: 2026-09-30T19:07:30.951Z

Link: CVE-2026-103540

cve-icon Vulnrichment

Updated: 2026-10-01T19:10:04.584Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T06:17:04.393

Modified: 2026-10-01T20:17:23.500

Link: CVE-2026-103540

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:30:08Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine

  • CWE-791

    Incomplete Filtering of Special Elements