{"affected":[{"defaultStatus":"unaffected","product":"bloofoxCMS","source":"CNA: VulnCheck","vendor":"Bloofox","versions":[{"lessThanOrEqual":"0.5.2.1","status":"affected","version":"0.5.1.0","versionType":"custom"}]}],"cveId":"CVE-2020-37241","cwes":["CWE-352"],"description":"bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.","epss":{"date":"2026-11-08","percentile":0.03855,"score":0.00146},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://www.exploit-db.com/exploits/49507"}],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794146381407,"publishedAt":1778945284200,"references":[{"source":"CNA: VulnCheck","tags":["exploit"],"url":"https://www.exploit-db.com/exploits/49507"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://www.bloofox.com/"},{"source":"CNA: VulnCheck","tags":["product","release-notes"],"url":"https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/bloofoxcms-cross-site-request-forgery-via-user-add"}],"remediation":[],"revision":"fc05fcab003759303ad1216505f5d880c4a25f280873ae6df1f5f9baa30e1a19","sources":[{"modifiedAt":1794146381407,"name":"CNA: VulnCheck","retrievedAt":1794146903467,"url":"https://www.cve.org/CVERecord?id=CVE-2020-37241"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150529705,"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37241"}],"ssvc":{"assessedAt":1779107931950,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add","updatedAt":1794150529705}