Browse CVEs

CRITICAL 9.8 CVE-2025-10251 A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The… Foxcms after 1.24 Fix from $2,3002025-09-11 HIGH 7.3 CVE-2025-56630 FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file. Foxcms after 1.2.5 Fix from $1,9502025-09-08 MEDIUM 5.3 CVE-2025-56435 SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the oper… Foxcms after 1.2.6 Fix from $1,6002025-09-03 HIGH 8.8 CVE-2025-55422 In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus. Foxcms No fix yet Fix from $1,9502025-08-27 HIGH 8.8 CVE-2025-55409 FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. Foxcms No fix yet Fix from $1,9502025-08-25 HIGH 8.8 CVE-2025-55420 A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is… Foxcms No fix yet Fix from $1,9502025-08-21 CRITICAL 9.8 CVE-2025-50692 FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html. Foxcms after 1.2.6 Fix from $2,3002025-08-07 HIGH 8.4 CVE-2025-46154 Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php. Foxcms Mitigation only Fix from $1,9502025-06-03 HIGH 8.8 CVE-2025-5155 A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the fi… Foxcms No fix yet Fix from $1,9502025-05-25 HIGH 7.2 CVE-2025-29181 FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php. Foxcms after 1.25 Fix from $1,9502025-04-17 HIGH 7.2 CVE-2025-29180 In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters… Foxcms after 1.25 Fix from $1,9502025-04-17 CRITICAL 9.8 CVE-2025-29306EPSS 46% An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Foxcms 1.2+ Fix from $2,3002025-03-27 CRITICAL 9.8 CVE-2025-25789 FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php. Foxcms No fix yet Fix from $2,3002025-02-26 CRITICAL 9.8 CVE-2025-25790 An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via… Foxcms No fix yet Fix from $2,3002025-02-26