286 matches found
FoxCMS 安全漏洞
FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.25 and previous versions of SQL injection vulnerability, the vulnerability stems from /admin/util/Field.php $param title parameter lack of validation of external input SQL statements. An attacker...
CVE-2025-29181
FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...
CVE-2025-29180
In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...
CVE-2025-29181
FOXCMS versions prior to V1.25 are vulnerable to SQL Injection due to a lack of validation on external input for the $param['title'] parameter in the /admin/util/Field.php file. An attacker can exploit this vulnerability to execute illegal SQL commands and steal sensitive database data . As of th...
CVE-2025-29181: Improper Neutralization of Special Elements used in an SQL Command
FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...
CVE-2025-29180
FOXCMS versions 1.25 and earlier are vulnerable to a time-based blind SQL injection vulnerability in the installdb.php file. The root cause is the direct concatenation of the url_prefix, domain, and my_website POST parameters into SQL statements without proper filtering. This flaw could allow an ...
PT-2025-17203 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: FOXCMS versions 1.25 and earlier Description: The issue concerns a time-based blind SQL injection vulnerability in the installdb.php file. The url prefix, domain, and my website POST parameters are directly concatenated into SQL statements...
FoxCMS 1.2.5 Remote Code Execution
FoxCMS version 1.2.5 proof of concept remote code execution exploit...
PT-2025-17204 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: FOXCMS versions prior to V1.25 Description: The issue allows for SQL Injection via the title parameter in the /admin/util/Field.php file. Recommendations: For versions prior to V1.25, consider restricting access to the title parameter in the...
CVE-2025-29181
FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...
FoxCMS 安全漏洞
FoxCMS is a free commercial open source content management system from China Qianhuox FoxCMS company. A security vulnerability exists in FoxCMS 1.25 and earlier versions, which stems from insufficient filtering of the urlprefix, domain and mywebsite parameters in the installdb.php file, which may...
CVE-2025-29180
In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...
CVE-2025-29180: Improper Neutralization of Special Elements used in an SQL Command
In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...
CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...
CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...
CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...
FoxCMS 代码注入漏洞
FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS version 1.2.5, which originates from the index.html component that allows execution of arbitrary code...
CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...
CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to achieve Remote Code Execution (RCE) via the case display page in the index.html component. The root cause is the unsafe use of unserialize() on attacker-controlled input and an insecure parameter parsing mechanism for the id parameter on the ...