CVE-2026-103540

MEDIUM 6.3

formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-1336 CWE-791
Vendor	formtools.org
Product	form tools
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for formtools.org form tools

Be the first to know when new medium vulnerabilities affecting formtools.org form tools are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

formtools.org / Form Tools

3.1.0 3.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/412350 vuldb.com: https://vuldb.com/vuln/412350/cti vuldb.com: https://vuldb.com/cve/CVE-2026-103540 vuldb.com: https://vuldb.com/submit/957845 github.com: https://github.com/formtools/core/issues/956 github.com: https://github.com/wawyw/cve_report/blob/main/formtools_1.md

Credits

🔍 wenyouwen (VulDB User) VulDB CNA Team