CVE-2025-45239: Improper Limitation of a Pathname to a Restricted Directory

An issue in the restores method DataBackup.php of foxcms v2.0.6 allows attackers to execute a directory traversal...

CVE-2025-45238: Improper Limitation of a Pathname to a Restricted Directory

foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method...

PT-2025-19753 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: foxcms version 1.2.5 Description: The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the delRestoreSerie method. Recommendations: For foxcms version 1.2.5, consider disabling the...

PT-2025-19729 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: foxcms version 1.2.5 Description: The issue is a SQL injection vulnerability via the executeCommand method in DataBackup.php. This vulnerability allows for potential SQL injection attacks. Recommendations: For foxcms version 1.2.5, consider...

PT-2025-19754 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: foxcms version 2.0.6 Description: An issue in the restores method of DataBackup.php allows attackers to execute a directory traversal. Recommendations: For foxcms version 2.0.6, consider restricting access to the restores method in...

FoxCMS security vulnerabilities

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS v1.2.5, which stems from improper handling of the delRestoreSerie method, which may result in the deletion of arbitrary files...

FoxCMS security vulnerabilities

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS v2.0.6, which originates from improper handling of the restores method in DataBackup.php, which may lead to a directory traversal attack...

FoxCMS security vulnerabilities

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS v1.2.5, which originates from improper handling of the executeCommand method in DataBackup.php, which may lead to SQL injection attacks...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

CVE-2025-29181

FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...

Exploit for Code Injection in Foxcms

CVE-2025-29306 - FoxCMS Remote Code Execution Exploit !Pytho...

FoxCMS Field.php File SQL Injection Vulnerability

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.25 and previous versions of SQL injection vulnerability, the vulnerability stems from /admin/util/Field.php $param title parameter lack of validation of external input SQL statements. An attacker...

Exploit for Code Injection in Foxcms

FOXCMS Parameter Injection RCE – CVE-2025-29306 This reposito...

FoxCMS 1.2.5 - Remote Code Execution (RCE)

Date: 2025-04-17 Exploit Title: Exploit Author: VeryLazyTech Vendor Homepage: https://www.foxcms.org/ Software Link: https://www.foxcms.cn/ Version: FoxCMS v.1.2.5 Tested on: Ubuntu 22.04, Windows Server 2019 CVE: CVE-2025-29306 Website: https://www.verylazytech.com !/bin/bash banner cat " exit 1...

CVE-2025-29181

FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...

CVE-2025-29181

FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

Exploit for Code Injection in Foxcms

POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution...

CVE-2025-29180: Improper Neutralization of Special Elements used in an SQL Command

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...