GHSA-qf2g-q4mc-w7rr
Cross-site Scripting in Fork CMS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | forkcms/forkcms | < 5.11.1 | 5.11.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
References
External links from the advisory. They lead to third-party sites.