Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
May 16, 2026bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into CVE-2020-37241 · Other software · Bloofox · reported by VulnCheckMedium 6.9
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.
- Product
- bloofoxCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious sCVE-2021-47906 · Other software · BloofoxCMS · reported by VulnCheckMedium 5.1
BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.
- Product
- BloofoxCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to CVE-2020-36082 · Other software · Bloofox · reported by MITRECritical 9.8
File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to upload module.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.CVE-2023-34756 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=charset&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.CVE-2023-34755 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mode=user&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.CVE-2023-34754 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.CVE-2023-34753 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=settings&page=tmpl&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.CVE-2023-34752 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devbloofox.com
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.CVE-2023-34751 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Jun 14, 2023bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=projects&action=edit.CVE-2023-34750 · Other software · Bloofox · reported by MITRECritical 9.8
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=settings&page=projects&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordndmcyb.hashnode.devndmcyb.hashnode.dev
Apr 13, 2023bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid=1.CVE-2023-29597 · Other software · Bloofox · reported by MITREHigh 8.8
bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid=1.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.CVE-2023-27812 · Other software · Bloofox · reported by MITRECritical 9.1
bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php.CVE-2023-23151 · Other software · Bloofox · reported by MITREMedium 6.5
bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit.CVE-2022-28528 · Other software · Bloofox · reported by MITREHigh 8.8
bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype.CVE-2021-44610 · Other software · Bloofox · reported by MITRECritical 9.8
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) eta_doctype. (6) meta_charset, (7) default_group, and (8) page group parameters in the settings mode in admin/index.php.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in CVE-2021-44608 · Other software · Bloofox · reported by MITREMedium 5.4
Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files.CVE-2020-35762 · Other software · Bloofox · reported by MITRELow 2.7
bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.CVE-2020-35761 · Other software · Bloofox · reported by MITREMedium 5.4
bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files).CVE-2020-35760 · Other software · Bloofox · reported by MITRECritical 9.8
bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files).
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely).CVE-2020-35759 · Other software · Bloofox · reported by MITREMedium 6.5
bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely).
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter.CVE-2020-36142 · Other software · Bloofox · reported by MITREMedium 6.5
BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header.CVE-2020-36141 · Other software · Bloofox · reported by MITREHigh 8.8
BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change anyCVE-2020-36140 · Other software · Bloofox · reported by MITREMedium 6.5
BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely).
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.CVE-2020-36139 · Other software · Bloofox · reported by MITREMedium 5.4
BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?modeCVE-2020-35709 · Other software · Bloofox · reported by MITREMedium 4.9
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.CVE-2010-4870 · Other software · Bloofox · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecurityreason.com
Dec 31, 2009Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search paraCVE-2009-4522 · Other software · Bloofox · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
Dec 29, 2008Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the (1) lang, (2) CVE-2008-5748 · Other software · Bloofox · reported by MITREHigh 8.1
Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files via the (1) lang, (2) theme, and (3) module parameters.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2008Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL cCVE-2008-0428 · Other software · Bloofoxcms · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to admin/index.php.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2008Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a ..CVE-2008-0427 · Other software · Bloo · reported by MITREHigh 7.8
Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2007PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the content_CVE-2007-2311 · Other software · Bloofoxcms · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the content_php parameter. NOTE: this issue has been disputed by a reliable third party, stating that content_php is initialized before use
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comattrition.org
Apr 26, 2007Cross-site scripting (XSS) vulnerability in plugins/spaw/img_popup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via thCVE-2007-2310 · Other software · Bloofoxcms · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in plugins/spaw/img_popup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the img_url parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.