BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting | Advisories

Advisories

BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting

severity: medium
date: January 22, 2026
Affecting: BloofoxCMS 0.5.1.0 - 0.5.2.1
CVE: CVE-2021-47906
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-49492
Official Vendor Homepage
BloofoxCMS Software Releases
Credit: LiPeiYi
Description: BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.