CVE-2019-15521

CRITICAL

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.

Affects 2 products across 2 vendors.

CVSS 3.09.8
EPSS2.5%
Percentile84th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Fork-Cms systems (CVE-2019-15521). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-205497-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-15521?
This vulnerability was disclosed in 2019. A critical vulnerability affects Fork-Cms systems (CVE-2019-15521). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-15521?
CVE-2019-15521 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.5%.
Is CVE-2019-15521 actively exploited?
No confirmed active exploitation of CVE-2019-15521 as of 2026-09-25.
How do I remediate CVE-2019-15521?
Priority: MEDIUM.
What systems are affected by CVE-2019-15521?
CVE-2019-15521 affects Fork-Cms Fork Cms; Spoon-Library Spoon Library.
Vulnerability Details
CVE IDCVE-2019-15521
BSIDBS-2019-GLOBAL-205497-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2019-08-26
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Fork-Cms Fork Cms < 1.4.1
Spoon-Library Spoon Library ≤ 2014-02-06
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2607 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash2d389ebb209a4b0ad79f0579cdb7d866c8e9ae1861604826296ffe0946f202e6079f5affcae8189b434d448dd6e1a6deec20f339b1c07958507941830abcaafd
Related CVEs affecting Fork-Cms
CVE-2021-28931 8.8 Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to cre... CVE-2020-23264 8.8 Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attac... CVE-2020-23960 8.8 Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Conso... CVE-2020-24036 8.8 PHP object injection in the Ajax endpoint of the backend in ForkCMS below ver... CVE-2022-1064 8.8 SQL injection through marking blog comments on bulk as spam in GitHub reposit...
View all Fork-Cms CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →