CVE-2025-41000

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.

CVSS

No CVSS.

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms

Configurations

No configuration.

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Cross-Frame Scripting (XFS) en BoomCMS v9.1.4 de UXB London. XFS es una técnica de ataque web que explota errores específicos del navegador para espiar a los usuarios a través de JavaScript. Este tipo de ataque se basa en ingeniería social y depende completamente del navegador elegido por el usuario, por lo que se percibe como una amenaza menor para la seguridad de las aplicaciones web. Esta vulnerabilidad solo funciona en navegadores antiguos.

Information

Published : 2025-09-03 11:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-41000

Mitre link : CVE-2025-41000

CVE.ORG link : CVE-2025-41000

JSON object : View

Products Affected

No product.

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-41000", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41000", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-03T14:03:30.829122Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "BoomCMS", "product": "BoomCMS", "versions": [{"status": "affected", "version": "9.1.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-03T11:15:30.730", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Frame Scripting (XFS) en BoomCMS v9.1.4 de UXB London. XFS es una t\u00e9cnica de ataque web que explota errores espec\u00edficos del navegador para espiar a los usuarios a trav\u00e9s de JavaScript. Este tipo de ataque se basa en ingenier\u00eda social y depende completamente del navegador elegido por el usuario, por lo que se percibe como una amenaza menor para la seguridad de las aplicaciones web. Esta vulnerabilidad solo funciona en navegadores antiguos."}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "cve-coordination@incibe.es"}