Read the docs
TI-2024-35718 Aliases CVE-2024-53255

Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00962 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed BoidCMS (BoidCMS): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoidCMSBoidCMSbefore 2.1.22.1.2Patch availableCNA
  • BoidCMS VendorBoidCMS Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:boidcms:boidcms:*:*:*:*:*:*:*:*before 2.1.2VulnerableBoidCMS
  • cpe:2.3:a:boidcms:boidcms:*:*:*:*:*:*:*:* Versions before 2.1.2 Vulnerable ·BoidCMS

Remediation

  • Fix · CNA BoidCMS (BoidCMS) Fixed in 2.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53255

References

Exploit 1

Patch 1

  • TI-2023-20116 File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute… CVSS 3.1HIGH 8.8
  • TI-2026-28372 BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter CVSS 3.1HIGH 7.2
  • TI-2024-21290 A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows… CVSS 3.1MEDIUM 6.1
  • TI-2024-21291 A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows… CVSS 3.1MEDIUM 6.1
  • TI-2023-26641 BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences