Cross-site Scripting (XSS)

2021-10-2613:36:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

fork cms

cross-site scripting

profiles module

javascript injection

EPSS

0.001

Percentile

24.8%

JSON

forkcms/forkcms is vulnerable to cross-site scripting attacks. The vulnerability exists because the ‘Displayname’ input field in ‘Profiles’ module is not properly encoded, which allows a malicious attacker to inject and execute arbitrary javascript.