CVE-2025-12920

<= 1.2.16

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admi

2.4LOW

CVE-2025-11306

<= 1.2

A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component

4.3MEDIUM

CVE-2025-10251

<= 1.24

A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/control

6.3MEDIUM

CVE-2025-56630

<= 1.2.5

FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file

7.3HIGH

CVE-2025-56435

<= 1.2.6

SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBack

5.3MEDIUM

CVE-2025-55422

all versions

In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.

8.8HIGH

CVE-2025-55409

all versions

FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code

8.8HIGH

CVE-2025-55420

all versions

A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a

8.8HIGH

CVE-2025-50692

<= 1.2.6

FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.

9.8CRITICAL

CVE-2025-51650

<= 1.2.6

An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute ar

5.6MEDIUM

CVE-2025-7568

<= 1.2.5

A vulnerability was found in qianfox FoxCMS up to 1.2.5. It has been classified as critical. Affected is the function batchCope of

6.3MEDIUM

CVE-2025-6094

<= 1.2.5

A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function b

6.3MEDIUM

CVE-2025-46154

all versions

Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.

8.4HIGH

CVE-2025-5155

all versions

A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function

6.3MEDIUM

CVE-2025-45239

all versions

An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.

5.3MEDIUM

CVE-2025-45238

all versions

foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.

9.1CRITICAL

CVE-2025-45240

all versions

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.

6.5MEDIUM

CVE-2025-29181

<= 1.25

FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.

7.2HIGH

CVE-2025-29180

<= 1.25

In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_webs

7.2HIGH

CVE-2025-29306

< 1.2

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html componen

9.8CRITICAL

CVE-2025-2653

all versions

A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The

4.3MEDIUM

CVE-2025-25790

all versions

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute

9.8CRITICAL

CVE-2025-25789

all versions

FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.

9.8CRITICAL

CVE-2024-12901

<= 1.2

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality o

5.3MEDIUM

CVE-2024-12900

<= 1.2

A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/in

6.3MEDIUM