Medium severity6.4NVD Advisory· Published Jan 23, 2026· Updated Apr 15, 2026

CVE-2021-47906

Description

BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bloofoxcms/Bloofoxcmsreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: = 0.5.2.1

Patches

Vulnerability mechanics

References

github.com/alexlang24/bloofoxCMS/releasesnvd
www.bloofox.comnvd
www.exploit-db.com/exploits/49492nvd
www.vulncheck.com/advisories/bloofoxcms-text-stored-cross-site-scriptingnvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000