CVE-2014-9470

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada fork-cms fork cms. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.

Rincian

Terbit di NVD

8 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.fork-cms.com/blog/detail/fork-3.8.4-released advisory vendor
• https://github.com/forkcms/forkcms/commit/4a7814762adf4f56f932d95146c7e4126d872114 patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2015/Jan/38 exploit · mailing list · advisory pihak ketiga
• http://www.securityfocus.com/bid/72017 advisory pihak ketiga · vdb entry
• http://www.itas.vn/news/itas-team-found-out-a-cross-site-scripting-vulnerability-in-fork-cms-70.html broken link
• https://github.com/forkcms/forkcms/issues/1018s broken link