CVE-2025-41000
Cross-Frame Scripting (XFS) in BoomCMS
- State
- Published
- Severity
- 2.1 Low
- Published
- Sep 3, 2025
- Updated
- Sep 3, 2025
- Reserved
- Apr 16, 2025
Description
Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | INCIBE |
Weaknesses
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected Products
| Product | Versions |
|---|---|
BoomCMSBoomCMS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.