CVE-2020-37241
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
May 16, 2026
Vendor
unknown
Description
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.