CVE-2014-9470

Description

References

• seclists.org/fulldisclosure/2015/Jan/38 · Exploit
• fork-cms.com/blog/detail/fork-3.8.4-released · Vendor Advisory
• itas.vn/news/itas-team-found-out-a-cross-site-scripting-vulnerability-in-fork-cms-70.html · Broken Link
• securityfocus.com/bid/72017 · Third Party Advisory
• forkcms/forkcms commit 4a78147 · Patch
• forkcms/forkcms · Broken Link

More vulnerabilities in fork cms

• CVE-2022-35590MEDIUM 4.8A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter
• CVE-2022-35589MEDIUM 4.8A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Paramete…
• CVE-2022-35587MEDIUM 4.8A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Paramete…
• CVE-2022-35585MEDIUM 4.8A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Par…
• CVE-2022-1064HIGH 8.8SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.