CVE-2024-6936

Katalog CVE

CVSS 4.9 · Medium EPSS 0,40%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada formtools form tools. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the argument Page Theme leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271991. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

21 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.271991 advisory pihak ketiga
• https://vuldb.com/?submit.372318 advisory pihak ketiga
• https://github.com/DeepMountains/Mirage/blob/main/CVE2-2.md broken link
• https://vuldb.com/?ctiid.271991 permissions required