Skip to content
OpenAdvisories

Package · Packagist

forkcms/forkcms

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 4.8
    CVE-2022-35585

    ForkCMS stored XSS via `start_date` parameter

    A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter

    forkcms/forkcms Packagist
  • Medium 4.8
    CVE-2022-35587

    ForkCMS XSS via `publish_on_date` parameter

    A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

    forkcms/forkcms Packagist
  • Medium 4.8
    CVE-2022-35589

    ForkCMS XSS via `publish_on_time` parameter

    A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter.

    forkcms/forkcms Packagist
  • Medium 4.8
    CVE-2022-35590

    ForkCMS XSS via `end_date` parameter

    A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter

    forkcms/forkcms Packagist
  • Medium 6.8
    CVE-2022-0145

    Cross-site Scripting (XSS) - Stored in forkcms/forkcms

    Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.

    forkcms forkcms/forkcms forkcms/forkcms Packagist
  • Medium 5.4
    CVE-2020-23049

    Cross-site scripting in forkcms

    Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web script…

    forkcms/forkcms Packagist
  • Medium 6.1
    CVE-2020-23263

    Cross-site scripting in forkcms

    Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.

    forkcms/forkcms Packagist
  • Medium 6.1
    CVE-2020-13633

    Fork CMS Cross-site Scripting Vulnerability

    Fork before 5.8.3 allows XSS via navigation_title or title.

    forkcms/forkcms Packagist
  • Medium 5.4
    CVE-2018-20682

    Fork CMS XSS Vulnerability

    Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

    forkcms/forkcms Packagist
  • Medium 5.4
    CVE-2018-5215

    Fork CMS XSS Vulnerability

    Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.

    forkcms/forkcms Packagist
  • Medium —
    CVE-2012-1188 Public exploit

    Fork CMS Multiple XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.

    forkcms/forkcms Packagist
  • Medium —
    CVE-2012-1209

    Fork CMS XSS via Highlight Parameter

    Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.

    forkcms/forkcms Packagist
  • Medium —
    CVE-2012-1207

    ForkCMS Directory Traversal vulnerability

    Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.

    forkcms/forkcms Packagist