day06-foxcms-rce

Day06 — FoxCMS风格的RCE CVE-2025-29306 — 教学实验室 这个小实验室模拟了 CVE-2025-29306 的核心思想：在攻击者控制的输入上不安全地使用 unserialize 导致远程代码执行。这是一个最小化、故意存在漏洞的教学复现版本 — 不是 FoxCMS 本身。 快速开始 chmod +x entrypoint.sh docker build -t day6-foxcms . docker run --rm -d -p 8080:80 --name day6 day6-foxcms Visit...

CVE-2025-29306-PoC-FoxCMS-RCE

CVE-2025-29306 - Exploit de Ejecución Remota de Código en FoxCMS Un exploit en Python para CVE-2025-29306, una vulnerabilidad de ejecución remota de código en FoxCMS. Esta herramienta permite probar objetivos individuales o escanear múltiples hosts en masa. Características Capacidad de escaneo de...

FOXCMS-CVE-2025-29306-POC

FOXCMS 参数注入 RCE – CVE-2025-29306 本仓库包含一个基于 Python 的 PoC，可复现影响 FOXCMS v1.2（一款中文开源内容管理系统）的远程代码执行（RCE）漏洞。 CVE 编号：CVE-2025-29306 影响版本：FOXCMS v1.2 类型：服务参数注入 → 代码执行 漏洞概述 FOXCMS 在 /images/index.html 端点的 id 参数中使用了不安全的参数解析机制。攻击者可利用 $@print 表达式注入载荷，从而导致 PHP 代码执行。 PoC 使用方法 环境要求 Python 3.x requests 库 pip...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html 代码执行漏洞 概述 FoxCMS v.1.2.5 中存在一个问题，允许远程攻击者通过 index.html 组件中的案例展示页面执行任意代码。 完整 POC 阅读相关详情 — CVE-2025-29306 免责声明 ：此概念验证（POC）仅用于教育和道德测试目的。未经事先双方同意，使用此工具攻击目标属违法行为。最终用户有责任遵守所有适用的当地、州和联邦法律。开发人员不承担任何责任，也不对由本程序引起的任何误用或损害负责。 开始使用 查找目标 要查找潜在目标，请使用 Fofa（类似于...

FoxCMS v.1.2.5 - Remote Code Execution

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. id: CVE-2025-29306 info: name: FoxCMS v.1.2.5 - Remote Code Execution author: ritikchaddha severity: critical description: | An issue in FoxCMS v.1.2.5 allows a...

CVE-2025-29306

CVE-2025-29306 FOXCMS黔狐内容管理系统服务参数注入漏洞 一、漏洞简介 FoxCMS是一套可免费商用且开源的网站管理系统,采用PHP+MySQL架构。 FOXCMS黔狐内容管理系统存在服务参数注入漏洞，攻击者可利用该漏洞获取服务器控制权。 二、漏洞影响 FOXCMS黔狐内容管理系统 V1.2 三、复现过程 POC http://xx/images/index.html?id=%24%40printphpinfo 输入Poc访问漏洞页面 发现phpinfo命令执行后的信息...

CVE-2025-29306_poc

描述 发布时间：2025-03-27 更新日期：2025-03-27 FoxCMS v.1.2.5 中存在一个问题，允许远程攻击者通过 index.html 组件中的案例展示页面执行任意代码。 使用方法： python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

Mass-CVE-2025-29306

FoxCMS Mass Exploiter CVE-2025-29306 Una herramienta de automatización especializada para que los investigadores de seguridad realicen pruebas de ejecución remota de comandos RCE en múltiples objetivos. 🛡️ Nota de seguridad Este programa está escrito en Bash y ha sido cifrado/compilado con SHC...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9608

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609 QianFox FoxCMS Admin.php edit password recovery

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

EUVD-2026-32029

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem...

CVE-2026-9609

CVE-2026-9609 affects QianFox FoxCMS up to version 1.2.6, targeting the Admin.php Edit function. The vulnerability enables weak password recovery through manipulation of the admin password flow, with remote initiation. Public exploit code exists, and the issue was reported via an issue but not ye...

CVE-2026-9608

CVE-2026-9608 affects QianFox FoxCMS (up to version 1.2.6) in the Administrator Backend, specifically the /Tag/edit function where a manipulated request can trigger cross-site scripting. The vulnerability arises from an unspecified element/function within that file, allowing remote exploitation. ...

EUVD-2026-32028

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-9608 QianFox FoxCMS Administrator Backend edit cross site scripting

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been...