FoxCMS v.1.2.5 - Remote Code Execution

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. id: CVE-2025-29306 info: name: FoxCMS v.1.2.5 - Remote Code Execution author: ritikchaddha severity: critical description: | An issue in FoxCMS v.1.2.5 allows a...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html 代码执行漏洞 概述 FoxCMS v.1.2.5 中存在一个问题，允许远程攻击者通过 index.html 组件中的案例展示页面执行任意代码。 完整 POC 阅读相关详情 — CVE-2025-29306 免责声明 ：此概念验证（POC）仅用于教育和道德测试目的。未经事先双方同意，使用此工具攻击目标属违法行为。最终用户有责任遵守所有适用的当地、州和联邦法律。开发人员不承担任何责任，也不对由本程序引起的任何误用或损害负责。 开始使用 查找目标 要查找潜在目标，请使用 Fofa（类似于...

CVE-2025-29306-PoC-FoxCMS-RCE

CVE-2025-29306 - FoxCMS 远程代码执行漏洞利用工具 这是一个针对 CVE-2025-29306 的 Python 漏洞利用工具，该漏洞是 FoxCMS 中的一个远程代码执行漏洞。此工具支持测试单个目标或批量扫描多个主机。 功能特性 支持单个目标或批量扫描 多线程扫描，速度更快 详细输出命令执行结果 自动将结果保存到文件 实时进度报告 易读的漏洞主机汇总表 安装 root@kitploit: git clone https://github.com/mattb709/CVE-2025-29306-PoC-FoxCMS-RCE .git cd...

FOXCMS-CVE-2025-29306-POC

FOXCMS Parameter Injection RCE – CVE-2025-29306 This repository contains a Python-based PoC for a Remote Code Execution RCE vulnerability affecting FOXCMS v1.2, a Chinese open-source content management system. CVE-ID: CVE-2025-29306 Affects: FOXCMS v1.2 Type: Service Parameter Injection → Code...

day06-foxcms-rce

Day06 — FoxCMS-style RCE CVE-2025-29306 — Educational lab This tiny lab simulates the core idea behind CVE-2025-29306 : unsafe use of unserialize on attacker-controlled input leading to remote code execution. This is a minimal, intentionally vulnerable educational replica — not FoxCMS itself...

CVE-2025-29306

CVE-2025-29306 FOXCMS黔狐内容管理系统服务参数注入漏洞 一、漏洞简介 FoxCMS是一套可免费商用且开源的网站管理系统,采用PHP+MySQL架构。 FOXCMS黔狐内容管理系统存在服务参数注入漏洞，攻击者可利用该漏洞获取服务器控制权。 二、漏洞影响 FOXCMS黔狐内容管理系统 V1.2 三、复现过程 POC http://xx/images/index.html?id=%24%40printphpinfo 输入Poc访问漏洞页面 发现phpinfo命令执行后的信息...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

Mass-CVE-2025-29306

FoxCMS 批量利用工具 CVE-2025-29306 专为安全研究人员设计的自动化工具，用于在多个目标上执行远程命令执行（RCE）测试。 🛡️ 安全说明 该程序使用 Bash 编写，并已通过 SHC （Shell 脚本编译器）进行加密/编译。源代码受到保护，以防止篡改和未经授权的修改。 📋 系统要求 为确保程序正常运行，请确保你的系统具备以下组件： curl python3 libxml2-utils 用于 xmllint 🚀 快速开始 1. 准备目标： 在与可执行文件相同的目录中创建一个名为 urls.txt 的文件。 注意：urls.txt 文件是必需的。 2. 将 URL 添加到...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

EUVD-2026-32029

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

CVE-2026-9609 affects QianFox FoxCMS up to version 1.2.6, targeting the Admin.php Edit function. The vulnerability enables weak password recovery through manipulation of the admin password flow, with remote initiation. Public exploit code exists, and the issue was reported via an issue but not ye...

CVE-2026-9608

CVE-2026-9608 affects QianFox FoxCMS (up to version 1.2.6) in the Administrator Backend, specifically the /Tag/edit function where a manipulated request can trigger cross-site scripting. The vulnerability arises from an unspecified element/function within that file, allowing remote exploitation. ...

EUVD-2026-32028

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...