ForkCMS XSS via `end_date` parameter

MEDIUM 4.8CVE-2022-35590 · GHSA-pw4j-r69m-rrr5 · Published 12/08/2022 · updated 17/06/2026

In short

CVE-2022-35590 is a MEDIUM (CVSS 4.8) vulnerability affecting forkcms/forkcms, fork cms (fork-cms).
Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.0% of all vulnerabilities.
Fix: update to 5.11.0 or later.

Package	Affected versions	Patched versions
forkcms/forkcms Packagist	`< 5.11.0`	`5.11.0`
fork cms fork-cms	`= 5.9.3`	No fix yet

Description

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the end_date Parameter. This issue was patched in version 5.11.0.

NVD description

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter

References

nvd.nist.gov/vuln/detail/CVE-2022-35590 · ADVISORY
forkcms/forkcms commit 76bf739 · WEB
forkcms/forkcms · PACKAGE
huntr.dev/bounties/4-other-forkcms · WEB
huntr.dev/bounties/4-other-forkcms · Exploit

More vulnerabilities in forkcms/forkcms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

forkcms/forkcms

Packagist

< 5.11.0

5.11.0

fork cms

fork-cms

= 5.9.3

No fix yet

Description

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the end_date Parameter. This issue was patched in version 5.11.0.

NVD description

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter

More vulnerabilities in forkcms/forkcms

See all →