Filtered by vendor Foxcms Subscriptions
Filtered by product Foxcms Subscriptions

Search

Switch to Advanced Search (Beta)
Total 10 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-6094 2 Foxcms, Qianfox 2 Foxcms, Foxcms 2025-07-16 6.3 Medium
A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-12901 2 Foxcms, Qianfox 2 Foxcms, Foxcms 2025-07-15 5.3 Medium
A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-12900 2 Foxcms, Qianfox 2 Foxcms, Foxcms 2025-07-15 6.3 Medium
A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-46154 1 Foxcms 1 Foxcms 2025-06-09 8.4 High
Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
CVE-2025-29306 1 Foxcms 1 Foxcms 2025-06-09 9.8 Critical
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
CVE-2025-5155 1 Foxcms 1 Foxcms 2025-06-03 6.3 Medium
A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/admin/controller/Article.php. The manipulation of the argument ids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-29180 1 Foxcms 1 Foxcms 2025-04-23 7.2 High
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
CVE-2025-29181 1 Foxcms 1 Foxcms 2025-04-23 7.2 High
FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
CVE-2025-25789 1 Foxcms 1 Foxcms 2025-04-09 9.8 Critical
FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
CVE-2025-25790 1 Foxcms 1 Foxcms 2025-04-09 9.8 Critical
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.