CVE-2020-23960

8.8 highEPSS 0.7%

High (8.8) in fork-cms fork cms. EPSS 0.7% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2021-01-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fork-cms:fork_cms

References

https://github.com/forkcms/forkcms/pull/3123
https://www.fork-cms.com/blog/detail/fork-5.8.3-released
https://github.com/forkcms/forkcms/pull/3123
https://www.fork-cms.com/blog/detail/fork-5.8.3-released

Check your stack JSON