61 matches found
CVE-2025-51650
FoxCMS version 1.2.6 contains an arbitrary file upload vulnerability within the /controller/PicManager.php component. This flaw allows an attacker to execute arbitrary code by uploading a crafted template file. To remediate this, users are advised to update to a newer version containing a fix. As...
PT-2025-29417 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: FoxCMS versions up to 1.2.5 Description: A critical issue exists in FoxCMS that allows for remote SQL injection. The batchCope function within the app/admin/controller/Video.php file is affected. Manipulation of the ids argument can lead to...
CVE-2025-6094
A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit...
CVE-2025-6094
A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit...
CVE-2025-6094
A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit...
CVE-2025-6094 qianfox FoxCMS Download.php batchCope sql injection
A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit...
PT-2025-25506 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: FoxCMS versions 1.2.5 and earlier Description: A critical issue has been found in FoxCMS, affecting the batchCope function of the file app/admin/controller/Download.php. The manipulation of the ids argument leads to SQL injection. The attack...
CVE-2025-46154
Foxcms v1.25 has a SQL time injection in the $POST'dbname' parameter of installdb.php...
CVE-2025-46154
Foxcms v1.25 has a SQL time injection in the $POST'dbname' parameter of installdb.php...
CVE-2025-5155
CVE-2025-5155 affects qianfox FoxCMS 1.2.5; the bug is in the batchCope function of app/admin/controller/Article.php, where manipulation of the ids argument enables SQL injection. The issue can be exploited remotely and exploitation has been publicly disclosed. Several sources confirm the vulnera...
CVE-2024-12901
A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be...
CVE-2025-45239
An issue in the restores method DataBackup.php of foxcms v2.0.6 allows attackers to execute a directory traversal...
PT-2025-19753 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: foxcms version 1.2.5 Description: The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the delRestoreSerie method. Recommendations: For foxcms version 1.2.5, consider disabling the...
PT-2025-19754 · Foxcms · Foxcms
Name of the Vulnerable Software and Affected Versions: foxcms version 2.0.6 Description: An issue in the restores method of DataBackup.php allows attackers to execute a directory traversal. Recommendations: For foxcms version 2.0.6, consider restricting access to the restores method in...
CVE-2025-45239
An issue in the restores method DataBackup.php of foxcms v2.0.6 allows attackers to execute a directory traversal...
CVE-2025-45238
foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method...
CVE-2025-45239
foxcms version v2.0.6 is vulnerable to a directory traversal attack due to improper handling within the restores method of the DataBackup.php file. An attacker can exploit this flaw to access files or directories outside the intended scope. As of the current reports, there is no updated version c...
CVE-2025-29181
FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...
