GHSA-q4qv-3x58-rxmh
ForkCMS XSS via `publish_on_time` parameter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | forkcms/forkcms | < 5.11.0 | 5.11.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the `publish_on_time` Parameter. This issue was patched in version 5.11.0.
References
External links from the advisory. They lead to third-party sites.