Threat database

CVE-2026-103542 is a server-side request forgery (SSRF) vulnerability in Form Tools up to version 3.1.1. The flaw exists in the smart_fill function within the AJAX Endpoint component, specifically in /global/code/actions.php. This vulnerability allows remote attackers to manipulate the url argument to induce the server to make unintended requests. Exploit code has been published, but no vendor response or patch is currently available.

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-103540 is a medium severity vulnerability in formtools.org Form Tools versions 3.1.0 and 3.1.1. It involves improper neutralization of special elements in the template engine within the Clients::updateClientSettingsTab function. This flaw allows remote attackers to manipulate the page_titles argument, potentially leading to security issues. The vulnerability has been publicly disclosed, but no patch or vendor response has been confirmed yet.