Medium severity6.4NVD Advisory· Published Jan 23, 2026· Updated Apr 15, 2026

CVE-2021-47906

Description

BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious scripts. Attackers can insert malicious javascript payloads in the text field to execute scripts and potentially steal authenticated users' cookies.

Affected products

Bloofoxcms/Bloofoxcmsreferences

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.bloofox.comnvd
www.exploit-db.com/exploits/49492nvd
www.vulncheck.com/advisories/bloofoxcms-text-stored-cross-site-scriptingnvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000