CVE-2021-38144

MEDIUM 5.4CVE-2021-38144 · Published 31/08/2021 · updated 17/06/2026

In short

CVE-2021-38144 is a MEDIUM (CVSS 5.4) vulnerability affecting core (formtools).
Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
core formtools	`≤ 3.0.20`	No fix yet

Description

An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?form_id=1&view_id=1&submission_id=[XSS].

References

bernardofsr.github.io/blog/2021/form-tools · Exploit
bernardofsr/CVEs-With-PoC · Exploit
formtools/core · Product
formtools.org · Product

More vulnerabilities in core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free