CVE-2021-38144

Name of the Vulnerable Software and Affected Versions: Form Tools versions 3.0.20 and earlier

Description: A low-privileged user can trigger Reflected XSS when viewing a form via the submission id parameter, for example, in the endpoint "clients/forms/edit submission.php?form id=1&view id=1&submission id=[XSS]".

Recommendations: For Form Tools versions 3.0.20 and earlier, as a temporary workaround, consider restricting access to the submission id parameter in the affected endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.