CVE-2025-46154

Foxcms v1.25 is vulnerable to a SQL time injection within the installdb.php script. The vulnerability exists because the $_POST['dbname'] parameter is improperly neutralized, allowing an attacker to execute time-based SQL commands. This could lead to a high impact on confidentiality, integrity, a...

CVE-2025-45240

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php...

FoxCMS Field.php File SQL Injection Vulnerability

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.25 and previous versions of SQL injection vulnerability, the vulnerability stems from /admin/util/Field.php $param title parameter lack of validation of external input SQL statements. An attacker...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

CVE-2025-29180

FOXCMS versions 1.25 and earlier are vulnerable to a time-based blind SQL injection vulnerability in the installdb.php file. The root cause is the direct concatenation of the url_prefix, domain, and my_website POST parameters into SQL statements without proper filtering. This flaw could allow an ...