CVE-2023-33971

MEDIUM 5.4CVE-2023-33971 · Published 31/05/2023 · updated 17/06/2026

In short

CVE-2023-33971 is a MEDIUM (CVSS 5.4) vulnerability affecting form creator (teclib-edition).
Chance of exploitation in the next 30 days (EPSS): 0.55%, higher than 46.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
form creator teclib-edition	`= 2.13.5`	No fix yet

Description

Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FULLFORM##` for rendering. This could result in arbitrary javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, one may use a regular expression to remove `< > "` in all fields.

References

pluginsGLPI/formcreator security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free