CVE-2025-46154

Foxcms v1.25 contains a SQL time injection in installdb.php via the $_POST['dbname'] parameter, enabling likely remote exploitation with high impact (CWE-style: SQL injection; CVSS v3.1 base score 8.4, LOCAL/vector L, no user interaction, high confidentiality/ integrity/ availability impact). The...

CVE-2025-45240

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php...

FoxCMS Field.php File SQL Injection Vulnerability

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.25 and previous versions of SQL injection vulnerability, the vulnerability stems from /admin/util/Field.php $param title parameter lack of validation of external input SQL statements. An attacker...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

CVE-2025-29180

FOXCMS