Foxcms

2 CVEs across 1 Foxcms products. Browse Foxcms vulnerabilities, severities, and proof-of-concept exploits.

Foxcms products with known CVEs

ProductCVEs
Foxcms15
Foxcms CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-12920Low2.42025-11-09A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi…
CVE-2025-10251Medium6.32025-09-11A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulat…
CVE-2025-56630High7.32025-09-08FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file.
CVE-2025-56435Medium5.32025-09-03SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on t…
CVE-2025-55422High8.82025-08-27In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.
CVE-2025-55409High8.82025-08-25FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code.
CVE-2025-55420High8.82025-08-21A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected…
CVE-2025-50692Critical9.82025-08-07FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
CVE-2025-46154High8.42025-06-03Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
CVE-2025-5155Medium6.32025-05-25A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/adm…
CVE-2025-29181High7.22025-04-17FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
CVE-2025-29180High7.22025-04-17In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are direc…
CVE-2025-29306Critical9.82025-03-27An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
CVE-2025-25790Critical9.82025-02-26An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading…
CVE-2025-25789Critical9.82025-02-26FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.