Skip to content
COOEY

FAIL › dossier

bloofoxcms

PRODUCT

· dossier confidence 40%

bloofoxCMS is a lightweight, open-source CMS that prioritizes ease of use and flexibility but suffers from a concerning security history. The vendor released software containing critical SQL injection and arbitrary file deletion vulnerabilities in 2023, indicating potential gaps in their security development lifecycle and patch management processes.

Failure events
2
Zero-days
0
RCEs
0
On KEV
0
Critical
2
Worst shame
35
PROFILE
Categoryopen-source softwareWhat they dobloofoxCMS is a free, open-source content management system (CMS) designed for managing websites and intranet sites with a simple, flexible architecture.Founded2012 Websitehttps://bloofox.com/ ↗
SECURITY POSTURE

The vendor has a poor security track record, evidenced by two critical vulnerabilities discovered in 2023 that affected multiple versions of the software.

Notable failures
  • CVE-2023-34752: SQL injection via lid parameter in admin settings
  • CVE-2023-27812: Arbitrary file deletion via delete_file() function
Patterns: critical unpatched vulnerabilities in core admin functions; lack of timely patching for critical flaws
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2023-06-14 CVE-2023-34752 critical bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=settings&page=lang&action=edit.
2023-04-13 CVE-2023-27812 critical bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
DOSSIER SOURCES
Open questions: When was bloofoxCMS founded? · What is the physical headquarters location of bloofoxCMS? · What is the organizational size of bloofoxCMS? · Who owns or sponsors bloofoxCMS?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-23 04:57:53.895154+00:00