Cross-site Scripting (XSS) - Stored in forkcms/forkcms


Reported on

Oct 19th 2021


XSS in the question asking session feedback page

Proof of Concept

Hi'>"<script src=//></script><x="{9*9}\r\n%0A%09%0D<svg\onload=confirm(1)>

link paste the payload in the question section and view the question in link


custom javascript code execution , session stealing etc

We have contacted a member of the forkcms team and are waiting to hear back 2 years ago
Ajmal Aboobacker modified the report
2 years ago
Jelmer Prins validated this vulnerability 2 years ago
Ajmal Aboobacker has been awarded the disclosure bounty
The fix bounty is now up for grabs
Jelmer Prins marked this as fixed in 5.11.0 with commit 76bf73 2 years ago
Jelmer Prins has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation