Cross-site Scripting (XSS) - Reflected in forkcms/forkcms

Valid

Reported on

Aug 5th 2021

✍️ Description

The forkcms is vulnerable to XSS through settings translation

Go to https://demo.fork-cms.com/private/en/locale
In search box named "Reference code" input "><svg/onload=alert(document.domain)>
XSS payload will be executed

An attacker can execute JavaScript code in the website

Index.php L328

We have contacted a member of the forkcms team and are waiting to hear back 2 years ago

Jelmer Prins marked this as fixed with commit 18b36b 2 years ago

This vulnerability will not receive a CVE

to join this conversation

We have contacted a member of the forkcms team and are waiting to hear back 2 years ago

Jelmer Prins marked this as fixed with commit 18b36b 2 years ago

This vulnerability will not receive a CVE

to join this conversation