https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-35590.htmlhttps://patchthecve.com/cve/CVE-2022-35590.htmlWed, 17 Jun 2026 04:51:58 +0000MEDIUM 4.8: A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameterhttps://patchthecve.com/cve/CVE-2022-35589.htmlhttps://patchthecve.com/cve/CVE-2022-35589.htmlWed, 17 Jun 2026 04:51:57 +0000MEDIUM 4.8: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter.https://patchthecve.com/cve/CVE-2022-35587.htmlhttps://patchthecve.com/cve/CVE-2022-35587.htmlWed, 17 Jun 2026 04:51:57 +0000MEDIUM 4.8: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameterhttps://patchthecve.com/cve/CVE-2022-35585.htmlhttps://patchthecve.com/cve/CVE-2022-35585.htmlWed, 17 Jun 2026 04:51:57 +0000MEDIUM 4.8: A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameterhttps://patchthecve.com/cve/CVE-2022-1064.htmlhttps://patchthecve.com/cve/CVE-2022-1064.htmlWed, 17 Jun 2026 04:21:45 +0000HIGH 8.8: SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.https://patchthecve.com/cve/CVE-2022-0153.htmlhttps://patchthecve.com/cve/CVE-2022-0153.htmlWed, 17 Jun 2026 04:20:03 +0000HIGH 7.5: SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.https://patchthecve.com/cve/CVE-2022-0145.htmlhttps://patchthecve.com/cve/CVE-2022-0145.htmlWed, 17 Jun 2026 04:20:02 +0000MEDIUM 5.4: Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.https://patchthecve.com/cve/CVE-2020-23049.htmlhttps://patchthecve.com/cve/CVE-2020-23049.htmlWed, 17 Jun 2026 03:04:30 +0000MEDIUM 5.4: Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.https://patchthecve.com/cve/CVE-2021-28931.htmlhttps://patchthecve.com/cve/CVE-2021-28931.htmlWed, 17 Jun 2026 03:47:03 +0000HIGH 8.8: Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.https://patchthecve.com/cve/CVE-2020-23264.htmlhttps://patchthecve.com/cve/CVE-2020-23264.htmlWed, 17 Jun 2026 03:04:38 +0000HIGH 8.8: Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.https://patchthecve.com/cve/CVE-2020-23263.htmlhttps://patchthecve.com/cve/CVE-2020-23263.htmlWed, 17 Jun 2026 03:04:38 +0000MEDIUM 6.1: Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.https://patchthecve.com/cve/CVE-2020-24036.htmlhttps://patchthecve.com/cve/CVE-2020-24036.htmlThu, 09 Jul 2026 00:17:00 +0000HIGH 8.8: PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.