CVE-2021-38143

An issue was discovered in Form Tools through 3.0.20

published August 31, 2021

CVSS
—
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01353 · 71.3th percentile
Published
2021-08-31T04:05Z
EPSS history
Timeline
  • 31 AUG 04:05Z
    An issue was discovered in Form Tools through 3.0.20
    cvelistv5