High severity8.8NVD Advisory· Published Mar 4, 2021· Updated Jul 9, 2026

CVE-2020-24036

Description

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ForkCMS/ForkCMSllm-fuzzy2 versions
<5.8.3+ 1 more
- (no CPE)range: <5.8.3
- (no CPE)
Fork CMS/Fork CMS
cpe:2.3:a:fork-cms:fork_cms:*:*:*:*:*:*:*:*
Range: <5.8.3

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2021/Mar/31nvdExploitMailing ListThird Party Advisory
tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036nvdExploitPatchThird Party Advisory
www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04nvdExploitPatchThird Party Advisory
packetstormsecurity.com/files/161764/ForkCMS-PHP-Object-Injection.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000