CVE-2021-38143

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.

• CWE-79

• https://bernardofsr.github.io/blog/2021/form-tools/Exploit, Third Party Advisory
• https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.mdExploit, Third Party Advisory
• https://github.com/formtools/coreProduct, Third Party Advisory
• https://www.formtools.org/Product, Vendor Advisory
• https://bernardofsr.github.io/blog/2021/form-tools/Exploit, Third Party Advisory
• https://github.com/bernardofsr/CVEs-With-PoC/blob/main/PoCs/Form%20Tools/README.mdExploit, Third Party Advisory
• https://github.com/formtools/coreProduct, Third Party Advisory
• https://www.formtools.org/Product, Vendor Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38136Corero SecureWatch Managed Services 9.7.2.0020 is affected b…6.5
• CVE-2021-38137Corero SecureWatch Managed Services 9.7.2.0020 does not corr…8.1
• CVE-2021-38138OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE…5.4
• CVE-2021-3814It was found that 3scale's APIdocs does not validate the acc…7.5
• CVE-2021-38140The set_user extension module before 2.0.1 for PostgreSQL al…9.8
• CVE-2021-38142Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext…8.8
• CVE-2021-38144An issue was discovered in Form Tools through 3.0.20. A low-…5.4
• CVE-2021-38145An issue was discovered in Form Tools through 3.0.20. SQL In…9.8
• CVE-2021-38146The File Download API in Wipro Holmes Orchestrator 20.4.1 (2…7.5
• CVE-2021-38147Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows …7.5
• CVE-2021-38148Obsidian before 0.12.12 does not require user confirmation f…9.8
• CVE-2021-38149index.php/admin/add_user in Chikitsa Patient Management Syst…5.4