PatchTheCVEfoxcms vulnerabilities and fixes
Recent CVEs affecting foxcms, with upgrade or downgrade steps. 22 tracked.
foxcms has 22 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 14. Most recent: 2025-11-09. Highest priority: CVE-2025-29306 (score 72/100).
- CVE-2025-10251 MEDIUM 6.3 UPGRADE A vulnerability was detected in FoxCMS up to 1.24
- CVE-2025-12920 LOW 2.4 UPGRADE A flaw has been found in qianfox FoxCMS up to 1.2.16
- CVE-2025-11306 MEDIUM 4.3 UPGRADE A vulnerability was found in qianfox FoxCMS up to 1.2
- CVE-2025-55422 HIGH 8.8 DOWNGRADE In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.
- CVE-2025-55409 HIGH 8.8 DOWNGRADE FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article
- CVE-2025-25790 CRITICAL 9.8 DOWNGRADE An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows
- CVE-2025-25789 CRITICAL 9.8 DOWNGRADE FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at
- CVE-2025-7568 MEDIUM 6.3 UPGRADE A vulnerability was found in qianfox FoxCMS up to 1.2.5
- CVE-2025-6094 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5
- CVE-2025-5155 MEDIUM 6.3 DOWNGRADE A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical
- CVE-2025-56630 HIGH 7.3 UPGRADE FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/contro
- CVE-2025-56435 MEDIUM 5.3 UPGRADE SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via
- CVE-2025-55420 HIGH 8.8 DOWNGRADE A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6
- CVE-2025-51650 MEDIUM 5.6 UPGRADE An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows att
- CVE-2025-50692 CRITICAL 9.8 UPGRADE FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
- CVE-2025-46154 HIGH 8.4 DOWNGRADE Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.
- CVE-2025-2653 MEDIUM 4.3 DOWNGRADE A vulnerability was found in FoxCMS 1.25 and classified as problematic
- CVE-2025-29306 CRITICAL 9.8 UPGRADE An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the
- CVE-2025-29181 HIGH 7.2 UPGRADE FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
- CVE-2025-29180 HIGH 7.2 UPGRADE In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability
- CVE-2024-12901 MEDIUM 5.3 UPGRADE A vulnerability classified as critical was found in FoxCMS up to 1.2
- CVE-2024-12900 MEDIUM 6.3 UPGRADE A vulnerability classified as critical has been found in FoxCMS up to 1.2
FAQ
How do I fix foxcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is foxcms being exploited right now?
None of the tracked foxcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which foxcms CVE should I patch first?
CVE-2025-29306 currently ranks highest (72/100): An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the.