CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36141
https://notcve.org/view.php?id=CVE-2020-36141
BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. BloofoxCMS versión 0.5.2.1, permite una vulnerabilidad de carga de archivos sin restricciones por medio de la omisión de la comprobación de MIME Type al insertar "image/jpeg" en el encabezado "Content-Type" • https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36142
https://notcve.org/view.php?id=CVE-2020-36142
BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. BloofoxCMS versión 0.5.2.1, permite una vulnerabilidad de Salto de Directorio al insertar cargas útiles "../" dentro del parámetro "fileurl" • https://muteb.io/2020/12/29/BloofoxCMS-Multiple-Vulnerabilities.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35709
https://notcve.org/view.php?id=CVE-2020-35709
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal. bloofoxCMS versión 0.5.2.1, permite a administradores cargar archivos .php arbitrarios (con "Content-Type:application/octet-stream") en ../media/images/ por medio de un URI admin/index.php?mode=tools&page=upload, también se conoce como salto de directorio • https://github.com/alexlang24/bloofoxCMS/issues/7 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 5CVE-2010-4870 – BloofoxCMS Registration Plugin - SQL Injection
https://notcve.org/view.php?id=CVE-2010-4870
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter. Vulnerabilidad de inyección SQL en index.php en BloofoxCMS v0.3.5 permite a atacantes remotos ejecutar comandos SQL a través del parámetro gender. • https://www.exploit-db.com/exploits/15328 http://packetstormsecurity.org/1010-exploits/bloofoxcms-sql.txt http://securityreason.com/securityalert/8427 http://www.exploit-db.com/exploits/15328 http://www.htbridge.ch/advisory/sql_injection_in_bloofoxcms_registration_plugin.html http://www.securityfocus.com/archive/1/514479/100/100/threaded http://www.securityfocus.com/bid/44464 https://exchange.xforce.ibmcloud.com/vulnerabilities/62810 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2009-4522 – BloofoxCMS 0.3.5 - 'search' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-4522
Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en search.5.html en BloofoxCMS v0.3.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro search sobre index.php. NOTA: algunos de estos detalles provienen de información de terceros. • https://www.exploit-db.com/exploits/33287 http://osvdb.org/58948 http://packetstormsecurity.org/0910-exploits/bloofoxcms-xss.txt http://secunia.com/advisories/37020 http://www.securityfocus.com/bid/36700 https://exchange.xforce.ibmcloud.com/vulnerabilities/53788 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •