medium4.8
CVE-2022-35585
ForkCMS stored XSS via `start_date` parameter
Impact
A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the `start_date` Parameter. This issue was patched in version 5.11.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | forkcms/forkcms | < 5.11.0 | 5.11.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fork-Cms | Fork Cms | Version 5.9.3 |