GCVE - cpe:2.3:a:bloofox:bloofoxcms:0.3.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bloofox:bloofoxcms:0.3.5:*:*:*:*:*:*:*

part: a version: 0.3.5 update: *

Vendor	Bloofox (`f050459d-6504-5066-b5ba-e3aa672cf04b`)
Product	Bloofoxcms (`065a6779-47ff-5067-bd87-29ba2aea37ea`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/alexlang24/bloofoxcms`	purl2cpe	2026-06-01 10:16:01.730019

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-37241`	vulnerable	2026-06-08 05:25:50.406312	bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add MEDIUM (5.3) bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent. Published: 2026-05-16T15:28:04.200Z Updated: 2026-05-26T21:27:32.486Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49507 https://www.bloofox.com/ https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 https://www.vulncheck.com/advisories/bloofoxcms-cross-site-request-forgery-via-user-add	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4870`	vulnerable	2026-06-08 04:56:31.302626	Details available SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter. Published: 2011-10-07T10:00:00.000Z Updated: 2024-08-07T04:02:29.960Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/514479/100/100/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/62810 http://www.exploit-db.com/exploits/15328 http://securityreason.com/securityalert/8427 http://packetstormsecurity.org/1010-exploits/bloofoxcms-sql.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4522`	vulnerable	2026-06-08 04:51:48.776958	Details available Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information. Published: 2009-12-31T19:00:00.000Z Updated: 2024-08-07T07:08:37.947Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/36700 http://osvdb.org/58948 https://exchange.xforce.ibmcloud.com/vulnerabilities/53788 http://secunia.com/advisories/37020 http://packetstormsecurity.org/0910-exploits/bloofoxcms-xss.txt	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.