Directory traversal

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

CVE-2020-36141

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

Unrestricted file upload

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2020-36139

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting XSS vulnerability by inserting a XSS payload within the 'fileurl' parameter...

CVE-2020-36139

CVE-2020-36139 affects BloofoxCMS 0.5.2.1. The vulnerability is a reflected XSS via the fileurl parameter, caused by unsanitized input that’s reflected in the page. Exploitation details are not provided in the documents; no in-the-wild exploit status is stated. Impact is consistent with a browser...

CVE-2020-36140

BloofoxCMS 0.5.2.1 is subject to a CSRF vulnerability that can be exploited by accessing the endpoint mode=settings&page=editor to change arbitrary file contents (locally or remotely). The issue is triggered through the specified endpoint, enabling an attacker to modify files without authenticati...

CVE-2020-36140

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

CVE-2020-36141

BloofoxCMS 0.5.2.1 is affected by an Unrestricted File Upload vulnerability caused by bypassing MIME-type validation through a Content-Type header (injecting image/jpeg). Multiple connected sources (CNVD, NVD, OSV, CVE records, PTA/PT- security entry) corroborate the issue and its association wit...

CVE-2020-36141

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2020-36142

Summary: CVE-2020-36142 affects BloofoxCMS 0.5.2.1, allowing directory traversal by injecting '../' payloads into the fileurl parameter. The vulnerability is documented across multiple sources (NVD, CNVD/CNNVD, OSV, PRION) with the BloofoxCMS description explicitly noting directory traversal via ...

CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

PT-2021-11926 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Cross-Site Request Forgery CSRF via the "mode=settings&page=editor" endpoint. This can be exploited to change any file content, both locally and remotely, by utilizing the...

BloofoxCms 跨站脚本漏洞

BloofoxCMS is a free and open source web content management system based on PHP+MySQL. A reflective cross-site scripting vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using the fileurl parameter to conduct cross-site scripting attacks...

PT-2021-11928 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows directory traversal by inserting '../' payloads within the fileurl parameter. This enables potential access to sensitive files and directories outside the intended directory structure...

PT-2021-11927 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Unrestricted File Upload by bypassing MIME Type validation. This can be achieved by inserting 'image/jpeg' within the 'Content-Type' header, potentially allowing malicious files to ...

BloofoxCMS 路径遍历漏洞

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A directory traversal vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by inserting the '... /' payload into the 'fileurl' parameter to achieve directory traversal...

BloofoxCms 代码问题漏洞

BloofoxCms is alexlang24 BloofoxCms individual developers of a Php-based text content management system. A code issue exists in BloofoxCMS version 0.5.2.1, which can be exploited to bypass MIME type validation by inserting "image jpeg" in the "Content-Type" header. The vulnerability can be...

BloofoxCms 跨站请求伪造漏洞

BloofoxCMS is a free open source PHP + MySQL based Web content management system . A cross-site request forgery vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using mode=settings&page=editor to change the content of arbitrary files...

PT-2021-11925 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Reflected Cross-Site Scripting XSS by inserting a XSS payload within the fileurl parameter. Recommendations: For BloofoxCMS version 0.5.2.1, avoid using the fileurl parameter until ...

bloofoxCMS 0.5.2.1 Cross Site Request Forgery

Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...