Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-1208 — Cross-site Scripting in Fork CMS

CWE-79 — Cross-site Scripting4 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
7.5%
top 8.18%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Fork-cms Fork CMS
Timeline
PublishedFeb 24
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-2gqc-rq92-c366: Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base↗2022-05-17
▶

💥Exploits & PoCs

2
Exploit-DB
Fork CMS 3.2.5 - Multiple Vulnerabilities↗2012-02-21
▶
Exploit-DB
Fork CMS 3.2.4 - Local File Inclusion / Cross-Site Scripting↗2012-02-12
▶
CVE-2012-1208 — Cross-site Scripting in Fork CMS | cvebase