Lipeiyi

A cross-site request forgery issue allows attackers to perform administrative actions by tricking authenticated users into visiting malicious pages. Attackers can use hidden forms targeting the admin user creation endpoint to create new administrative accounts with arbitrary credentials without the user's consent.

BloofoxCMS contains a stored cross-site scripting issue. Authenticated attackers can inject malicious scripts through the `text` parameter in the articles section. This allows for the execution of scripts and potential theft of authenticated users' cookies.