CVE-2025-41000

LOW EPSS 24.1%

Published Sep 3, 202510mo ago · Modified Jun 17, 20262w ago

2.1 CVSS 4.0

Low

Published Sep 3, 2025 10mo ago

Last Modified Jun 17, 2026 2w ago

Description

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.

CVSS Details

Base Score

2.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

24.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-1021

References 1

incibe.es https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.