Foxcms
by Foxcms
CVEs (27)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-29180 | 0.00 | — | 0.00 | Apr 17, 2025 | In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering. | |||
| CVE-2025-29181 | 0.00 | — | 0.00 | Apr 17, 2025 | FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php. | |||
| CVE-2025-2653 | 0.00 | — | 0.00 | Mar 23, 2025 | A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | |||
| CVE-2025-25790 | 0.00 | — | 0.01 | Feb 26, 2025 | An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file. | |||
| CVE-2025-25789 | 0.00 | — | 0.01 | Feb 26, 2025 | FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php. | |||
| CVE-2024-12901 | 0.00 | — | 0.01 | Dec 23, 2024 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The… | |||
| CVE-2024-12900 | 0.00 | — | 0.01 | Dec 23, 2024 | A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible… |
- CVE-2025-29180Apr 17, 2025risk 0.00cvss —epss 0.00
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
- CVE-2025-29181Apr 17, 2025risk 0.00cvss —epss 0.00
FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
- CVE-2025-2653Mar 23, 2025risk 0.00cvss —epss 0.00
A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CVE-2025-25790Feb 26, 2025risk 0.00cvss —epss 0.01
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- CVE-2025-25789Feb 26, 2025risk 0.00cvss —epss 0.01
FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
- CVE-2024-12901Dec 23, 2024risk 0.00cvss —epss 0.01
A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The…
- CVE-2024-12900Dec 23, 2024risk 0.00cvss —epss 0.01
A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible…
Page 2 of 2