Cross-site scripting in forkcms

2022-02-1022:29:03

Google

osv.dev

0.001 Low

EPSS

Percentile

45.5%

JSON

Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the “navigation_title” parameter and the “title” parameter in /private/en/pages/add.

CPENameOperatorVersion
forkcms/forkcmseq5.4.0
forkcms/forkcmseq4.5.0
forkcms/forkcmseq3.9.6
forkcms/forkcmseq3.8.0
forkcms/forkcmseq5.6.0
forkcms/forkcmseq4.2.3
forkcms/forkcmseq4.0.4
forkcms/forkcmseq5.0.0
forkcms/forkcmseq5.8.0
forkcms/forkcmseq4.2.1

Name	Operator	Version
forkcms/forkcms	eq	5.4.0
forkcms/forkcms	eq	4.5.0
forkcms/forkcms	eq	3.9.6
forkcms/forkcms	eq	3.8.0
forkcms/forkcms	eq	5.6.0
forkcms/forkcms	eq	4.2.3
forkcms/forkcms	eq	4.0.4
forkcms/forkcms	eq	5.0.0
forkcms/forkcms	eq	5.8.0
forkcms/forkcms	eq	4.2.1