Page 3 of 26 results (0.011 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-36141

https://notcve.org/view.php?id=CVE-2020-36141

04 Jun 2021 — BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. BloofoxCMS versión 0.5.2.1, permite una vulnerabilidad de carga de archivos sin restricciones por medio de la omisión de la comprobación de MIME Type al insertar "image/jpeg" en el encabezado "Content-Type" • https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-36142

https://notcve.org/view.php?id=CVE-2020-36142

04 Jun 2021 — BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. BloofoxCMS versión 0.5.2.1, permite una vulnerabilidad de Salto de Directorio al insertar cargas útiles "../" dentro del parámetro "fileurl" • https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-35709

https://notcve.org/view.php?id=CVE-2020-35709

25 Dec 2020 — bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal. bloofoxCMS versión 0.5.2.1, permite a administradores cargar archivos .php arbitrarios (con "Content-Type:application/octet-stream") en ../media/images/ por medio de un URI admin/index.php?mode=tools&page=upload, también se conoce como salto de directorio • https://github.com/alexlang24/bloofoxCMS/issues/7 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 5

CVE-2010-4870 – BloofoxCMS Registration Plugin - SQL Injection

https://notcve.org/view.php?id=CVE-2010-4870

07 Oct 2011 — SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter. Vulnerabilidad de inyección SQL en index.php en BloofoxCMS v0.3.5 permite a atacantes remotos ejecutar comandos SQL a través del parámetro gender. • https://www.exploit-db.com/exploits/15328 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2009-4522 – BloofoxCMS 0.3.5 - 'search' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2009-4522

31 Dec 2009 — Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en search.5.html en BloofoxCMS v0.3.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro search sobre index.php. NOTA: algunos de estos de... • https://www.exploit-db.com/exploits/33287 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.1EPSS: 14%CPEs: 1EXPL: 2

CVE-2008-5748 – BloofoxCMS 0.3.4 - 'lang' Local File Inclusion

https://notcve.org/view.php?id=CVE-2008-5748

29 Dec 2008 — Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the (1) lang, (2) theme, and (3) module parameters. Vulnerabilidad de salto de directorio en plugins/spaw2/dialogs/dialog.php en BloofoxCMS 0.3.4, permite a atacantes remotos leer ficheros de su elección a través de los parámetros (1) "lang", (2) "theme", y (3) "module". • https://www.exploit-db.com/exploits/7580 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •