CVE-2020-35761

CVE-2020-35761 affects bloofoxCMS 0.5.2.1, where a cross-site scripting (XSS) vulnerability exists that allows remote attackers to execute arbitrary JavaScript/HTML code. The connected sources consistently describe a XSS in bloofoxCMS 0.5.2.1, but do not provide concrete exploitation details, aff...

CVE-2020-35762

bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files...

CVE-2020-35762

The data confirms a concrete vulnerability: bloofoxCMS 0.5.2.1 has a path traversal flaw in the fileurl parameter that can read local files. Affected software: bloofoxCMS (PHP + MySQL-based CMS). Root cause: improper sanitization/validation in the fileurl parameter enabling traversal sequences. I...

bloofoxCMS 代码问题漏洞

bloofoxCMS is a free open source PHP + MySQL based Web content management system . An unrestricted file upload vulnerability exists in bloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability to upload malicious files...

BloofoxCms 跨站脚本漏洞

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A cross-site scripting vulnerability exists in bloofoxCMS version 0.5.2.1. A remote attacker can exploit this vulnerability to execute arbitrary JS/HTML code...

BloofoxCMS Path Traversal Vulnerability

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A directory traversal vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by inserting the '... /' payload into the 'fileurl' parameter to achieve directory traversal...

BloofoxCMS Cross-Site Scripting Vulnerability (CNVD-2021-40550)

BloofoxCMS is a free and open source web content management system based on PHP+MySQL. A reflective cross-site scripting vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using the fileurl parameter to conduct cross-site scripting attacks...

BloofoxCMS Cross-Site Request Forgery Vulnerability

BloofoxCMS is a free open source PHP + MySQL based Web content management system . A cross-site request forgery vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using mode=settings&page=editor to change the content of arbitrary files...

BloofoxCms File Upload Vulnerability

BloofoxCms is alexlang24 BloofoxCms individual developers of a Php-based text content management system. A code issue exists in BloofoxCMS version 0.5.2.1, which can be exploited to bypass MIME type validation by inserting "image jpeg" in the "Content-Type" header. The vulnerability can be...

CVE-2020-36141

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2020-36139

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting XSS vulnerability by inserting a XSS payload within the 'fileurl' parameter...

CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

CVE-2020-36141

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

CVE-2020-36140

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

CVE-2020-36139

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting XSS vulnerability by inserting a XSS payload within the 'fileurl' parameter...

CVE-2020-36140

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

Cross site scripting

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting XSS vulnerability by inserting a XSS payload within the 'fileurl' parameter...

Cross site request forgery (csrf)

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

CVE-2020-36140

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...