medium4.8
CVE-2022-35587
ForkCMS XSS via `publish_on_date` parameter
Impact
A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the `publish_on_date` Parameter. This issue was patched in version 5.11.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | forkcms/forkcms | < 5.11.0 | 5.11.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fork-Cms | Fork Cms | Version 5.9.3 |