CVE-2021-38143

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bernardofsr.github.io/blog/2021/form-tools/Exploit, Third Party Advisory
https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.mdExploit, Third Party Advisory
https://github.com/formtools/coreProduct, Third Party Advisory
https://www.formtools.org/Product, Vendor Advisory
https://bernardofsr.github.io/blog/2021/form-tools/Exploit, Third Party Advisory
https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.mdExploit, Third Party Advisory
https://github.com/formtools/coreProduct, Third Party Advisory
https://www.formtools.org/Product, Vendor Advisory

Timeline

Published: Aug 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381445.4An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submissi CVE-2021-381459.8An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (clie CVE-2021-381467.5The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p CVE-2021-381477.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti CVE-2021-381489.8Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.CVE-2021-381495.4index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38159.8utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-381506.5When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP CVE-2021-381515.4index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381525.4index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381535.9Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute for CVE-2021-381547.5Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP