CVE-2025-41000CWE-1021

CVE-2025-41000

published September 3, 2025

CVSS
2.1
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-09-03T15:15Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms · [email protected]
EPSS history
Timeline
  • 03 SEP 11:04Z
    Cross-Frame Scripting (XFS) in BoomCMS
    cvelistv5