The vulnerability in formtools.org Form Tools up to version 3.1.1 affects the Clients::updateClientSettingsTab function in the global/code/Clients.class.php file. Improper neutralization of special elements used in the template engine occurs when the page_titles argument is manipulated. This can be triggered remotely, potentially allowing an attacker to exploit the template engine processing. The issue was reported early to the project but remains unaddressed, and public exploit details exist.

The vulnerability could allow remote attackers to manipulate template engine elements, potentially leading to unintended behavior or information disclosure. The CVSS 4.0 score of 5.3 indicates a medium impact with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has not been confirmed to be exploited in the wild.

No official patch or fix is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting access to the affected functionality or applying custom input validation to the page_titles argument to mitigate exploitation risk.