CVE-2012-1208: Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and p...

Security readout for executives and security teams

Fork CMS 3.2.4, and possibly earlier versions before 3.2.5, allowed attacker-supplied text to be reflected into backend pages as script or HTML. If an administrator followed a crafted link or visited an affected backend view, the attacker could potentially run script in that admin’s browser session. Exposure is most likely where Fork CMS 3.2.4, or possibly another pre-3.2.5 version, is still deployed and the backend is reachable by administrators. Internet exposure of the admin interface increases phishing and session-risk impact, but the source bundle does not confirm broad product usage or exact affected version range. Handle as a targeted CMS backend risk, not a confirmed mass-exploitation emergency. Prioritize remediation if Fork CMS is internet-facing, used by privileged administrators, or still on 3.2.4/pre-3.2.5. The main business concern is compromise of administrative browser sessions and downstream site control. Mitigation focus: Upgrade Fork CMS to 3.2.5 or later if vendor guidance supports it.; Review the linked vendor commits before backporting fixes.; Restrict access to the Fork CMS backend where operationally possible..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.