Skip to content
OpenAdvisories

Vendor

BoidCMS

2 known vulnerabilities.

Products

BoidCMS 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.2
    CVE-2026-39387 Public exploit

    BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter

    BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code …

    BoidCMS BoidCMS