CVE-2020-23263

Name of the Vulnerable Software and Affected Versions Fork CMS version 5.8.2

Description The issue allows remote attackers to inject arbitrary Javascript code via the navigation title parameter and the title parameter in the "/private/en/pages/add" endpoint. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Fork CMS version 5.8.2, consider disabling the navigation title and title parameters in the "/private/en/pages/add" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the navigation title and title parameters in the affected endpoint until the issue is resolved.