{"id":"CVE-2021-47906","state":"PUBLISHED","title":"BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting","description":"BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.","publishedAt":"2026-01-23T16:47:44.644Z","updatedAt":"2026-03-05T01:29:13.068Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["BloofoxCMS BloofoxCMS"],"affected":[{"vendor":"BloofoxCMS","product":"BloofoxCMS","versions":[{"version":"0.5.1.0 - 0.5.2.1","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/49492","https://www.bloofox.com/","https://github.com/alexlang24/bloofoxCMS/releases","https://www.vulncheck.com/advisories/bloofoxcms-text-stored-cross-site-scripting"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47906.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47906","state":"PUBLISHED","datePublished":"2026-01-23T16:47:44.644Z","dateUpdated":"2026-03-05T01:29:13.068Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-18T12:35:05.177Z"},"containers":{"cna":{"title":"BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting","descriptions":[{"lang":"en","value":"BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies."}],"affected":[{"vendor":"BloofoxCMS","product":"BloofoxCMS","versions":[{"version":"0.5.1.0 - 0.5.2.1","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/49492","name":"ExploitDB-49492","tags":["exploit"]},{"url":"https://www.bloofox.com/","name":"Official Vendor Homepage","tags":["product"]},{"url":"https://github.com/alexlang24/bloofoxCMS/releases","name":"BloofoxCMS Software Releases","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/bloofoxcms-text-stored-cross-site-scripting","name":"VulnCheck Advisory: BloofoxCMS 0.5.2.1 - 'text' Stored Cross Site Scripting","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:29:13.068Z"},"datePublic":"2020-12-18T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bloofox:bloofoxcms:0.5.2.1:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"LiPeiYi","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.exploit-db.com/exploits/49492","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-23T20:56:19.832235Z","id":"CVE-2021-47906","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-23T21:44:13.132Z"}}]}}}