CVE-2021-44610

BloofoxCMS v0.5.2.1 through v0.5.1 contains SQL injection vulnerabilities due to insufficient validation of several parameters (URLs, lang_id, tmpl_id, mod_rewrite, eta_doctype, meta_charset, default_group, page group) in admin/index.php settings mode. The root cause is lack of input validation f...

CVE-2020-35759

bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...

CVE-2020-35759

bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...

CVE-2020-36140

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery CSRF via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content Locally/Remotely...

Directory traversal

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

CVE-2020-36142

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter...

PT-2021-11927 · Unknown · Bloofoxcms

Name of the Vulnerable Software and Affected Versions: BloofoxCMS version 0.5.2.1 Description: The issue allows for Unrestricted File Upload by bypassing MIME Type validation. This can be achieved by inserting 'image/jpeg' within the 'Content-Type' header, potentially allowing malicious files to ...

bloofoxCMS 0.5.2.1 Cross Site Request Forgery

Title: bloofoxCMS 0.5.2.1 - CSRF Add user Exploit Author: LiPeiYi Date: 2020-12-18 Vendor Homepage: https://www.bloofox.com/ Software Link: https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 Version: 0.5.1.0 -.5.2.1 Tested on: windows 10 Desc: The application interface allows users to...