CVE-2024-53255

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-532567.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a com CVE-2024-532574.9Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do CVE-2024-532585.3Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can d CVE-2024-532596.5quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected qui CVE-2024-53268.8The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due CVE-2024-532606.8Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to i CVE-2024-532615.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* CVE-2024-532625.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors CVE-2024-532638.5Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of t CVE-2024-532645.1bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint CVE-2024-532665.4Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled CVE-2024-532675.5sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situ