CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

CVE-2020-36142

Summary: CVE-2020-36142 affects BloofoxCMS 0.5.2.1, allowing directory traversal by injecting '../' payloads into the fileurl parameter. The vulnerability is documented across multiple sources (NVD, CNVD/CNNVD, OSV, PRION) with the BloofoxCMS description explicitly noting directory traversal via ...

CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

PT-2021-11928 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows directory traversal by inserting '../' payloads within the fileurl parameter. This enables potential access to sensitive files and directories outside the intended directory structure...

PT-2021-11927 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Unrestricted File Upload by bypassing MIME Type validation. This can be achieved by inserting 'image/jpeg' within the 'Content-Type' header, potentially allowing malicious files to ...

CVE-2020-36142: Improper Limitation of a Pathname to a Restricted Directory

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

PT-2021-11925 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Reflected Cross-Site Scripting XSS by inserting a XSS payload within the fileurl parameter. Recommendations: For BloofoxCMS version 0.5.2.1, avoid using the fileurl parameter until ...

CVE-2020-36139: Improper Neutralization of Input During Web Page Generation

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting XSS vulnerability by inserting a XSS payload within the 'fileurl' parameter...

CVE-2020-36141: Unrestricted Upload of File with Dangerous Type

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header...

CVE-2020-36140: Cross-Site Request Forgery (CSRF)

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

BloofoxCms 代码问题漏洞

BloofoxCms is alexlang24 BloofoxCms individual developers of a Php-based text content management system. A code issue exists in BloofoxCMS version 0.5.2.1, which can be exploited to bypass MIME type validation by inserting "image jpeg" in the "Content-Type" header. The vulnerability can be...

BloofoxCms 跨站请求伪造漏洞

BloofoxCMS is a free open source PHP + MySQL based Web content management system . A cross-site request forgery vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using mode=settings&page=editor to change the content of arbitrary files...

BloofoxCms 跨站脚本漏洞

BloofoxCMS is a free and open source web content management system based on PHP+MySQL. A reflective cross-site scripting vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by using the fileurl parameter to conduct cross-site scripting attacks...

PT-2021-11926 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Cross-Site Request Forgery CSRF via the "mode=settings&page=editor" endpoint. This can be exploited to change any file content, both locally and remotely, by utilizing the...

BloofoxCMS 路径遍历漏洞

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A directory traversal vulnerability exists in BloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability by inserting the '... /' payload into the 'fileurl' parameter to achieve directory traversal...

bloofoxCMS 0.5.2.1 Cross Site Request Forgery

Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...

bloofoxCMS 0.5.2.1 - CSRF (Add user)

Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...

BloofoxCMS 0.5.2.1 Cross Site Scripting

Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Vulnerable paper:...

BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

Title: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Vulnerable paper:...

BloofoxCMS Directory Traversal Vulnerability

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A directory traversal vulnerability exists in bloofoxCMS 0.5.2.1. An attacker can exploit this vulnerability by using the admin/index.php?mode=tools&page=upload URI to upload any .php file to . /media/images/...