CVE-2021-47906: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting
BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47906?
The severity of CVE-2021-47906 is considered high due to its stored cross-site scripting nature that allows authenticated attackers to inject malicious scripts.
How do I fix CVE-2021-47906?
To fix CVE-2021-47906, it is recommended to sanitize and validate all user inputs in the articles text parameter to prevent script injection.
Who is affected by CVE-2021-47906?
CVE-2021-47906 affects users of BloofoxCMS version 0.5.2.1 who can authenticate and submit content via the articles text parameter.
What kind of attack can be performed with CVE-2021-47906?
With CVE-2021-47906, an attacker can perform a stored cross-site scripting attack by injecting malicious JavaScript payloads that can execute in the context of other users.
Is there a patch available for CVE-2021-47906?
As of now, there is no specific patch mentioned for CVE-2021-47906, but upgrading to a more secure version or applying appropriate input sanitization can mitigate the issue.