Cross-Frame Scripting (XFS) in BoomCMS
BoomCMS, version 9.1.4.
INCIBE has coordinated the publication of a low-severity vulnerability affecting BoomCMS from UXB London, an easy-to-use content management system. The vulnerability was discovered by Sergio Corchado Lucero.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2025-41000: CVSS v4.0: 2.1 | CVSS AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-1021
No solution has been reported at this time.
CVE-2025-41000: Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
