PatchTheCVEfork-cms vulnerabilities
Recent CVEs affecting fork-cms products. 12 tracked.
fork-cms has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-08-12. Highest priority: CVE-2020-24036 (score 58/100).
- CVE-2020-24036 HIGH 8.8 UPGRADE PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticate
- CVE-2022-35590 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript v
- CVE-2022-35589 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via
- CVE-2022-35587 MEDIUM 4.8 DOWNGRADE A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via
- CVE-2022-35585 MEDIUM 4.8 DOWNGRADE A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaS
- CVE-2022-1064 HIGH 8.8 UPGRADE SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11
- CVE-2022-0153 HIGH 7.5 UPGRADE SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
- CVE-2022-0145 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
- CVE-2021-28931 HIGH 8.8 DOWNGRADE Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in
- CVE-2020-23264 HIGH 8.8 UPGRADE Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication
- CVE-2020-23263 MEDIUM 6.1 DOWNGRADE Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbi
- CVE-2020-23049 MEDIUM 5.4 DOWNGRADE Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability
FAQ
How do I fix fork-cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fork-cms being exploited right now?
None of the tracked fork-cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fork-cms CVE should I patch first?
CVE-2020-24036 currently ranks highest (58/100): PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticate.