PatchTheCVEfork cms vulnerabilities and fixes
Recent CVEs affecting fork cms, with upgrade or downgrade steps. 13 tracked.
Also searched as: forkcms.
fork cms has 13 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2022-08-12. Highest priority: CVE-2020-24036 (score 58/100).
- CVE-2020-24036 HIGH 8.8 UPGRADE PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticate
- CVE-2022-35590 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript v
- CVE-2022-35589 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via
- CVE-2022-35587 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via
- CVE-2022-35585 MEDIUM 4.8 DOWNGRADE A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaS
- CVE-2022-1064 HIGH 8.8 UPGRADE SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11
- CVE-2022-0153 HIGH 7.5 UPGRADE SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
- CVE-2022-0145 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
- CVE-2021-28931 HIGH 8.8 DOWNGRADE Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in
- CVE-2020-23960 HIGH 8.8 UPGRADE Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows re
- CVE-2020-23264 HIGH 8.8 UPGRADE Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication
- CVE-2020-23263 MEDIUM 6.1 DOWNGRADE Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbi
- CVE-2020-23049 MEDIUM 5.4 DOWNGRADE Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability
FAQ
How do I fix fork cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fork cms being exploited right now?
None of the tracked fork cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fork cms CVE should I patch first?
CVE-2020-24036 currently ranks highest (58/100): PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticate.