CVE-2014-9470 Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML v...
MediumCVSS 6.1
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fork-cms fork cms | < 3.8.4 | 3.8.4 |
References
- seclists.org exploit mailing-list third-party-advisory
- www.fork-cms.com vendor-advisory
- www.itas.vn broken-link
- www.securityfocus.com third-party-advisory vdb-entry
- github.com patch third-party-advisory
- github.com broken-link