CVE-2022-35587

ForkCMS XSS via `publish_on_date` parameter

4.8 MediumFix available

CVE-2022-35587 is a medium vulnerability (CVSS 4.8) in Fork-cms Fork Cms, published August 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 57th percentile. Fixed in forkcms/forkcms 5.11.0.

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.84%Down 0.2 points since Aug 13, 2022

What each source reports

NVD Score used 4.8

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

Record: CVE-2022-35587
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

Record: CVE-2022-35587
Updated: 2026-11-02

EUVDEUVD-2022-6492 No score

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

Record: EUVD-2022-6492
Updated: 2026-11-03

GitHub AdvisoriesGHSA-65wf-qm95-6mhm 4.8

ForkCMS XSS via `publish_on_date` parameter

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the publish_on_date Parameter. This issue was patched in version 5.11.0.

Record: GHSA-65wf-qm95-6mhm
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-65wf-qm95-6mhm 4.8

ForkCMS XSS via `publish_on_date` parameter

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the publish_on_date Parameter. This issue was patched in version 5.11.0.

Record: GHSA-65wf-qm95-6mhm
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter

Record: CVE-2022-35587
Updated: 2026-11-02

Affected products

fork-cms fork cms

Affected packages

Affected packages
Package	Affected	Fixed
`forkcms/forkcms` Packagist	before 5.11.0	5.11.0
`forkcms/forkcms` Packagist	before 5.11.0, plus listed versions 3.5.03.5.13.6.03.6.13.6.2 Show 45 moreShow less 3.6.33.6.43.6.53.6.63.73.7.13.7.23.7.33.8.03.8.13.8.23.8.33.8.43.8.53.8.63.8.73.9.03.9.13.9.23.9.33.9.43.9.53.9.64.0.04.0.14.0.24.0.34.0.44.0.54.0.64.1.04.1.14.1.24.2.04.2.14.2.24.2.34.2.44.3.04.3.14.4.04.4.14.5.04.5.14.5.2	5.11.0

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 37 versions. The JSON record has them.