CVE-2014-9470 — Cross-site Scripting in Fork CMS

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
6.1MEDIUMNVD
EPSS
0.9%
top 24.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fork-cms Fork CMS
Timeline
PublishedFeb 8
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDfork-cms/fork_cms< 3.8.4

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-rh8q-83xv-8vw7: Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index↗2022-05-17
▶
CVE-2014-9470 — Cross-site Scripting in Fork CMS | cvebase