Fork Cms@* Security Vulnerabilities and Issues — Fork Cms@* CVE List

Lucene search

Fork-cmsFork Cms*

12 matches found

CVE•added 2022/03/24 5:15 p.m.•96 views

CVE-2022-0153

SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.

9.6CVSS8AI score0.00257EPSS

CVE•added 2022/03/25 12:15 p.m.•95 views

CVE-2022-1064

SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.

9CVSS9.1AI score0.00282EPSS

CVE•added 2020/02/08 5:15 p.m.•90 views

CVE-2014-9470

Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.

6.1CVSS6AI score0.0087EPSS

CVE•added 2022/03/24 11:15 a.m.•81 views

CVE-2022-0145

Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.

6.8CVSS5.3AI score0.00328EPSS

CVE•added 2021/05/06 10:15 p.m.•57 views

CVE-2020-23264

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.

8.8CVSS8.9AI score0.00111EPSS

CVE•added 2021/03/04 1:15 p.m.•57 views

CVE-2020-24036

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.

8.8CVSS8.8AI score0.01279EPSS

CVE•added 2021/01/11 4:15 p.m.•53 views

CVE-2020-23960

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resettin...

8.8CVSS8.8AI score0.00205EPSS

CVE•added 2012/09/26 12:55 a.m.•49 views

CVE-2012-1188

Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.

4.3CVSS5.7AI score0.1384EPSS

CVE•added 2015/02/06 3:59 p.m.•43 views

CVE-2015-1467

Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index.

7.5CVSS8.1AI score0.01345EPSS

CVE•added 2019/08/26 1:15 p.m.•34 views

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.

9.8CVSS9.6AI score0.00678EPSS

CVE•added 2012/09/26 12:55 a.m.•29 views

CVE-2012-5164

Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax.

4.3CVSS5.9AI score0.00446EPSS

CVE•added 2020/05/27 4:15 p.m.•29 views

CVE-2020-13633

Fork before 5.8.3 allows XSS via navigation_title or title.

6.1CVSS5.9AI score0.0024EPSS