Fork-cms
Fork-cms Fork CMS: vulnerabilidades y CVE
Fork-cms Fork CMS tiene 25 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE25
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-35590 | Media (4.8) | 0.74% | — | 12 ago 2022 | A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter |
| CVE-2022-35589 | Media (4.8) | 0.75% | — | 12 ago 2022 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter. |
| CVE-2022-35587 | Media (4.8) | 0.77% | — | 12 ago 2022 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter |
| CVE-2022-35585 | Media (4.8) | 0.77% | — | 12 ago 2022 | A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter |
| CVE-2022-1064 | Alta (8.8) | 1.2% | — | 25 mar 2022 | SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1. |
| CVE-2022-0153 | Alta (7.5) | 1.1% | — | 24 mar 2022 | SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1. |
| CVE-2022-0145 | Media (5.4) | 0.68% | — | 24 mar 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1. |
| CVE-2020-23049 | Media (5.4) | 0.60% | — | 22 oct 2021 | Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows… |
| CVE-2021-28931 | Alta (8.8) | 1.2% | — | 7 jul 2021 | Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel. |
| CVE-2020-23264 | Alta (8.8) | 0.63% | — | 6 may 2021 | Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators. |
| CVE-2020-23263 | Media (6.1) | 0.84% | — | 6 may 2021 | Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add. |
| CVE-2020-24036 | Alta (8.8) | 3.0% | — | 4 mar 2021 | PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code. |
| CVE-2020-23960 | Alta (8.8) | 0.68% | — | 11 ene 2021 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's… |
| CVE-2020-13633 | Media (6.1) | 0.68% | — | 27 may 2020 | Fork before 5.8.3 allows XSS via navigation_title or title. |
| CVE-2014-9470 | Media (6.1) | 1.4% | — | 8 feb 2020 | Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget… |
| CVE-2019-15521 | Crítica (9.8) | 2.5% | — | 26 ago 2019 | Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object. |
| CVE-2018-20682 | Media (5.4) | 0.56% | — | 9 ene 2019 | Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section). |
| CVE-2018-17595 | Media (6.1) | 1.0% | — | 2 oct 2018 | In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI. |
| CVE-2018-5215 | Media (5.4) | 0.54% | — | 4 ene 2018 | Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter. |
| CVE-2015-1467 | Alta (7.5) | 2.4% | — | 6 feb 2015 | Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to… |
| CVE-2012-5164 | Media (4.3) | 1.2% | — | 26 sept 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php,… |
| CVE-2012-1188 | Media (4.3) | 4.5% | — | 26 sept 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name… |
| CVE-2012-1209 | Media (4.3) | 1.2% | — | 24 feb 2012 | Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight… |
| CVE-2012-1208 | Media (4.3) | 4.1% | — | 24 feb 2012 | Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1)… |
| CVE-2012-1207 | Media (5) | 1.9% | — | 24 feb 2012 | Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module… |