Vulnerabilities
23 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-36082 | File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2023-34752 | bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit. NVD description · AI analysis pending | 9.8 | 4% | PoC |
| — | |
| CVE-2023-27812 +1 in the same advisory: …29597 | bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function. bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function. NVD description · AI analysis pending | 9.1 group max | 1% | PoC |
| — | |
| CVE-2023-23151 | bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php. bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php. NVD description · AI analysis pending | 6.5 | 1% | PoC |
| — | |
| CVE-2022-28528 | bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit. bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit. NVD description · AI analysis pending | 8.8 | 1% | PoC |
| — | |
| CVE-2021-44610 +1 in the same advisory: …44608 | Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. (6) meta_charset, (7) default_group, and (8) page group parameters in the settings mode in admin/index.php. NVD description · AI analysis pending | 9.8 group max | 1% | PoC |
| — | |
| CVE-2020-35760 | bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files). NVD description · AI analysis pending | 9.8 group max | 2% | PoC |
| — | |
| CVE-2020-36141 | BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. NVD description · AI analysis pending | 8.8 group max | 1% | PoC |
| — | |
| CVE-2020-35709 | bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal. NVD description · AI analysis pending | 4.9 | 1% | PoC |
| — |