CVE-2020-37241CWE-352csrf

CVE-2020-37241

Medium · published May 16, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-05-16T20:16Z
References (4)
https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1 · [email protected]https://www.bloofox.com/ · [email protected]https://www.exploit-db.com/exploits/49507 · [email protected]https://www.vulncheck.com/advisories/bloofoxcms-cross-site-request-forgery-via-user-add · [email protected]
EPSS history
Timeline
  • 16 MAY 15:28Z
    bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add
    cvelistv5