VulnerabilityDeferred

CVE-2025-41000

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London.

LOW 2.1EPSS 0.35%

Does this matter?

Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.35% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-1021
Source: cve-coordination@incibe.es

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.