Fork-Cms / Fork Cms
25 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2022-35585 | A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter | MEDIUM | 4.8 | Aug 12, 2022 |
| CVE-2022-35587 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter | MEDIUM | 4.8 | Aug 12, 2022 |
| CVE-2022-35589 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter. | MEDIUM | 4.8 | Aug 12, 2022 |
| CVE-2022-35590 | A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter | MEDIUM | 4.8 | Aug 12, 2022 |
| CVE-2022-1064 | SQL injection through marking blog comments on bulk as spam in forkcms/forkcms | HIGH | 8.8 | Mar 25, 2022 |
| CVE-2022-0153 | SQL Injection in forkcms/forkcms | HIGH | 7.5 | Mar 24, 2022 |
| CVE-2022-0145 | Cross-site Scripting (XSS) - Stored in forkcms/forkcms | MEDIUM | 5.4 | Mar 24, 2022 |
| CVE-2020-23049 | Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`,… | MEDIUM | 5.4 | Oct 22, 2021 |
| CVE-2021-28931 | Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file upl… | HIGH | 8.8 | Jul 7, 2021 |
| CVE-2020-23264 | Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators. | HIGH | 8.8 | May 6, 2021 |
| CVE-2020-23263 | Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title"… | MEDIUM | 6.1 | May 6, 2021 |
| CVE-2020-24036 | PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code. | HIGH | 8.8 | Mar 4, 2021 |
| CVE-2020-23960 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as… | HIGH | 8.8 | Jan 11, 2021 |
| CVE-2020-13633 | Fork before 5.8.3 allows XSS via navigation_title or title. | MEDIUM | 6.1 | May 27, 2020 |
| CVE-2014-9470 | Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers… | MEDIUM | 6.1 | Feb 8, 2020 |
| CVE-2019-15521 | Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object. | CRITICAL | 9.8 | Aug 26, 2019 |
| CVE-2018-20682 | Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section). | MEDIUM | 5.4 | Jan 9, 2019 |
| CVE-2018-17595 | In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI. | MEDIUM | 6.1 | Oct 2, 2018 |
| CVE-2018-5215 | Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter. | MEDIUM | 5.4 | Jan 4, 2018 |
| CVE-2015-1467 | Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1)… | HIGH | 7.5 | Feb 6, 2015 |
| CVE-2012-5164 | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term paramet… | MEDIUM | 4.3 | Sep 26, 2012 |
| CVE-2012-1188 | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or… | MEDIUM | 4.3 | Sep 26, 2012 |
| CVE-2012-1209 | Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to… | MEDIUM | 4.3 | Feb 20, 2012 |
| CVE-2012-1208 | Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote att… | MEDIUM | 4.3 | Feb 20, 2012 |
| CVE-2012-1207 | Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to… | MEDIUM | 5.0 | Feb 20, 2012 |
Showing 1 to 25 of 25 CVEs