{"id":"GHSA-v3fg-x8jw-m974","aliases":["CVE-2012-1209"],"title":"Fork CMS XSS via Highlight Parameter","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Cross-site scripting (XSS) vulnerability in `backend/core/engine/base.php` in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.","severity":"medium","score":null,"published":"2022-05-14T03:51:05.000Z","modified":"2024-01-12T16:56:49.609Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"forkcms/forkcms","sources":[{"name":"OSV · GHSA-v3fg-x8jw-m974","url":"https://osv.dev/vulnerability/GHSA-v3fg-x8jw-m974"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.2.5"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["3.2.5"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2012-1209","https://github.com/forkcms/forkcms/commit/c8ec9c58a6b3c46cdd924532c1de99bcda6072ed","https://github.com/forkcms/forkcms/commit/df75e0797a6540c4d656969a2e7df7689603b2cf","https://exchange.xforce.ibmcloud.com/vulnerabilities/73393","https://github.com/forkcms/forkcms","http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released"],"sources":[{"name":"OSV","id":"GHSA-v3fg-x8jw-m974","modified":"2024-01-12T16:56:49.609242Z","url":"https://osv.dev/vulnerability/GHSA-v3fg-x8jw-m974"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T18:20:33.032Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}