CVE-2025-41000 Cross-Frame Scripting (XFS) in BoomCMS
Cross-Frame Scripting in BoomCMS allows attackers to spy on users via JavaScript in older browsers, potentially leading to data theft or account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-41000?
CVE-2025-41000 is a low-severity cross-site scripting vulnerability in BoomCMS, published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
Weakness: CWE-1021
Which versions are affected by CVE-2025-41000?
How do I fix CVE-2025-41000?
No fix has been published for CVE-2025-41000 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-41000 being exploited?
There is no known exploitation of CVE-2025-41000 in the wild and no public exploit code.
Sources
Also known as GHSA-97mj-hh96-r6f4.