CVE-2021-38143

MEDIO 6.1CVE-2021-38143 · Published 31/08/2021 · updated 17/06/2026

In breve

CVE-2021-38143 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda core (formtools).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 71.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
core formtools	`≤ 3.0.20`	No fix yet

Description

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.

References

bernardofsr.github.io/blog/2021/form-tools · Exploit
bernardofsr/CVEs-With-PoC · Exploit
formtools/core · Product
formtools.org · Product

Altre vulnerabilità di core

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free