Vulnerabilities

TI-2026-08440 CVE-2026-9609 · GHSA-8w64-6cpx-85ph

QianFox FoxCMS Admin.php edit password recovery

MEDIUM 56

A vulnerability was identified in QianFox FoxCMS up to 1.2.6.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00223 Published 2026-05-27 No fix listed CWE-640

TI-2026-08439 CVE-2026-9608 · GHSA-jrpj-9599-5gw6

QianFox FoxCMS Administrator Backend edit cross site scripting

MEDIUM 55

A vulnerability was determined in QianFox FoxCMS up to 1.2.6.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00206 Published 2026-05-27 No fix listed CWE-79

TI-2025-11837 CVE-2025-12920 · GHSA-x22m-wwr6-j767

qianfox FoxCMS Product.php edit cross site scripting

MEDIUM 55

A flaw has been found in qianfox FoxCMS up to 1.2.16.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00356 Published 2025-11-09 No fix listed CWE-79

TI-2025-10354 CVE-2025-11306 · GHSA-6c59-6393-4j79

qianfox FoxCMS Search cross site scripting

MEDIUM 57

A vulnerability was found in qianfox FoxCMS up to 1.2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00343 Published 2025-10-05 No fix listed CWE-79

TI-2025-06905 CVE-2025-7568 · GHSA-mm97-v4m7-rrwx

qianfox FoxCMS Video.php batchCope sql injection

MEDIUM 57

A vulnerability was found in qianfox FoxCMS up to 1.2.5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00473 Published 2025-07-14 No fix listed CWE-74

TI-2025-32382 CVE-2025-51650 · GHSA-4f6v-52xw-69q3

An arbitrary file upload vulnerability in the component /controller/PicManager.php of…

HIGH 66

An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00323 Published 2025-07-14 No fix listed CWE-77

TI-2025-05504 CVE-2025-6094 · GHSA-gcq5-qc75-mh9g

qianfox FoxCMS Download.php batchCope sql injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00463 Published 2025-06-15 No fix listed CWE-74

TI-2025-04624 CVE-2025-5155 · GHSA-8pj5-84fx-c3xh

qianfox FoxCMS Article.php batchCope sql injection

MEDIUM 57

A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00516 Published 2025-05-25 No fix listed CWE-74

TI-2025-28747 CVE-2025-45240 · GHSA-hf7x-p9xq-fhxq

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.

LOW 31

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00312 Published 2025-05-05 No fix listed CWE-89

TI-2025-28746 CVE-2025-45239 · GHSA-4x3p-5fw4-h8vm

An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.

MEDIUM 63

An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00729 Published 2025-05-05 No fix listed CWE-22

TI-2025-28745 CVE-2025-45238 · GHSA-9wf6-v4mm-mrhf

foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.

HIGH 78

foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00685 Published 2025-05-05 No fix listed CWE-22

TI-2025-02319 CVE-2025-2653 · GHSA-hj88-g9rf-7f79

FoxCMS improper authorization

LOW 24

A vulnerability was found in FoxCMS 1.25 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00329 Published 2025-03-23 No fix listed CWE-266

TI-2024-11954 CVE-2024-12901 · GHSA-c7c2-9xjm-5c75

FoxCMS API Endpoint Site.php improper authorization

LOW 37

A vulnerability classified as critical was found in FoxCMS up to 1.2.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00629 Published 2024-12-23 No fix listed CWE-266

TI-2024-11953 CVE-2024-12900 · GHSA-q495-wf8m-qxcf

FoxCMS Configuration File installdb.php code injection

LOW 25

A vulnerability classified as critical has been found in FoxCMS up to 1.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00747 Published 2024-12-23 No fix listed CWE-74

Vulnerabilities

Filters