CVE-2024-12901

FoxCMS up to version 1.2 is affected by a critical issue in the API Endpoint, specifically in /app/api/controller/Site.php, where manipulating the password argument leads to improper authorization. The vulnerability enables remote exploitation, and the exploit has been publicly disclosed. Multipl...

CVE-2025-6094

FoxCMS (versions up to 1.2.5) contains a SQL injection in the batchCope function of app/admin/controller/Download.php, triggered by manipulating the ids parameter. The vulnerability allows remote exploitation and has publicly disclosed exploits. Publicly available advisories (e.g., PT-2025-25506)...

CVE-2025-2653

FoxCMS 1.25 is affected by CVE-2025-2653, which is described as an improper authorization vulnerability that can be exploited remotely. The connected sources consistently reference FoxCMS 1.25 and indicate a remote-attack vector with unknown details about the exact vulnerable component or entry p...

CVE-2025-45238

The content management system foxcms v1.2.5 contains an arbitrary file deletion vulnerability caused by improper handling in the delRestoreSerie method. This flaw allows for the deletion of files outside the intended directory, potentially impacting the integrity and availability of the system. T...

CVE-2025-45239

foxcms version v2.0.6 is vulnerable to a directory traversal attack due to improper handling within the restores method of the DataBackup.php file. An attacker can exploit this flaw to access files or directories outside the intended scope. As of the current reports, there is no updated version c...

CVE-2024-12900

FoxCMS CVE-2024-12900 affects the Configuration File Handler’s /install/installdb.php. The root cause is manipulation of the database password argument, enabling code injection. The vulnerability is exploitable remotely and has public disclosures. Affected versions are FoxCMS up to 1.2; PT-Securi...

CVE-2025-45240

The foxcms content management system, specifically version 1.2.5 , is vulnerable to a SQL injection vulnerability. The flaw resides in the executeCommand method within the DataBackup.php file due to improper handling of input. This could allow an attacker to perform SQL injection attacks against ...

CVE-2025-51650

FoxCMS version 1.2.6 contains an arbitrary file upload vulnerability within the /controller/PicManager.php component. This flaw allows an attacker to execute arbitrary code by uploading a crafted template file. To remediate this, users are advised to update to a newer version containing a fix. As...

CVE-2025-11306

FoxCMS (qianfox) up to version 1.2 contains a cross-site scripting flaw in the Search Page component, specifically in /index.php/Search where manipulation of the keyword parameter enables remote exploitation. Multiple sources (NVD, Red Hat, EUVD, CVE lists, and vendor/information aggregators) con...

CVE-2025-7568

FoxCMS up to version 1.2.5 is affected by a SQL injection in the batchCope function of app/admin/controller/Video.php. The vulnerability arises from manipulating the ids argument, allowing remote exploitation. The issue has been publicly disclosed and is not confirmed as fixed; vendor response st...