Filtered by vendor Boidcms Subscriptions
Filtered by product Boidcms Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-53255 1 Boidcms 1 Boidcms 2024-11-25 N/A
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-32343 1 Boidcms 1 Boidcms 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
CVE-2024-32342 1 Boidcms 1 Boidcms 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Permalink parameter.
CVE-2023-48824 1 Boidcms 1 Boidcms 2024-11-21 5.4 Medium
BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a page=create action.
CVE-2023-38836 1 Boidcms 1 Boidcms 2024-11-21 8.8 High
File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.