118 matches found
CVE-2020-24036
ForkCMS prior to version 5.8.3 is affected by PHP object injection via the backend Ajax endpoint. The vulnerability allows an authenticated remote user to inject PHP objects through unserialize calls in the Ajax handlers, enabling remote code execution. The issue is specific to ForkCMS’s backend ...
PT-2021-11001
Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.8.3 Description: The issue allows an authenticated remote user to execute malicious code due to PHP object injection in the Ajax endpoint of the backend. Recommendations: For versions prior to 5.8.3, update to...
CVE-2020-24036: Deserialization of Untrusted Data
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code...
Fork ForkCMS 安全漏洞
ForkCMS is an open source content management system CMS written in PHP. A PHP object injection vulnerability exists in the back-end Ajax endpoint of ForkCMS versions prior to 5.8.3. A remote authenticated attacker can exploit this vulnerability to execute malicious code...
Cross-site Scripting (XSS) - Generic in forkcms/forkcms
Description ForkCMS is an easy to use open source CMS using Symfony Components this package is vulnerable to Stored Cross-Site Scripting XSS. https://github.com/forkcms/forkcms Steps To Reproduce-: 1 install https://github.com/forkcms/forkcms locally or https://demo.fork-cms.com/private/ use demo...
Cross-site Scripting (XSS)
forkcms/forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the data values provided by the user such as navigationtitle and pageTitle in the function createHtml, allowing a malicious user to inject and execute malicious web script...
Cross-Site Scripting (XSS)
forkcms/forkcms is vulnerable to cross-site scripting XSS. The facebookadminids parameter under the application's private settings is not validated and HTML encoded before being displayed on a user's browser, allowing a remote attacker to inject arbitrary Javascript into the victim's browser...
ForkCMS 5.0.6 Cross Site Scripting
Stored Cross-site Scripting Vulnerabilities in ForkCMS 5.0.6 Information -------------------- Advisory by Netsparker Name: Stored Cross-site Scripting Vulnerabilities in ForkCMS Affected Software: ForkCMS Affected Versions: 5.0.6 Homepage: https://www.fork-cms.com/ Vulnerability: Stored Cross-sit...
Cross-site Scripting (XSS)
forkcms is vulnerable to cross-site scripting XSS attacks. The library does not properly escape special characters in the src/Backend/Modules/Search/Actions/Statistics.php file, allowing a malicious user to inject and execute arbitrary web script...
Open Redirect
forkcms is vulnerable to open redirect attacks. The library uses the target='blank' parameter in its links, granting the linked page partial access to the window.object object, which can then be used to redirect a user to a malicious page...
Cross-site Scripting (XSS)
forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape user input strings in the loadDataGrids function in src/Backend/Modules/Blog/Actions/Comments.php, allowing a malicious user to inject and execute web script...
SQL Injection
forkcms is vulnerable to SQL injection. Attackers can leverage a flaw in the language or type parameters in the translations feature to execute SQL commands...
forkcms 3.2.5 - Multiple Vulnerabilities
ForkCMS 3.2.5以及更低版本存在CSRF和XSS反射型漏洞。IMB X-Force确认3.2.6版本也存在CSRF漏洞。 1.CSRF ForkCMS 3.2.5存在CSRF漏洞，攻击者可删除admins/users用户，删除网页，并且当授权的admin用户访问包含以下html/javascript代码的网页时可提权： 1.1删除Admins或Users用户 CSRF Exploit to delete ADMIN/USER account 注意第一个能删除的ID是2而不是1。因为1是安装阶段创建的超级管理员，称为"Fork CMS"（ForkCMS 定义了...
ForkCMS 3.2.5 Multiple Vulnerabilities
Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Author : Ivano Binetti http://ivanobinetti.com Software...
ForkCMS 3.2.5 Cross Site Request Forgery / Cross Site Scripting
+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Date : 21-02-2012 Author : Ivano Binetti http://ivanobinetti.com Software link : http://www.fork-cms.com/downlo...
Fork CMS 3.2.5 - Multiple Vulnerabilities
Fork CMS 3.2.5 - Multiple Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Date : 21-02-2012 Author : Ivano Binetti http://ivanobinetti.com...
Fork CMS 3.2.5 - Multiple Vulnerabilities
+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Date : 21-02-2012 Author : Ivano Binetti http://ivanobinetti.com Software link :...
