https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12920.htmlhttps://patchthecve.com/cve/CVE-2025-12920.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 2.4: A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publishttps://patchthecve.com/cve/CVE-2025-10251.htmlhttps://patchthecve.com/cve/CVE-2025-10251.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 6.3: A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. Thhttps://patchthecve.com/cve/CVE-2025-56630.htmlhttps://patchthecve.com/cve/CVE-2025-56630.htmlWed, 17 Jun 2026 09:42:42 +0000HIGH 7.3: FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file.https://patchthecve.com/cve/CVE-2025-56435.htmlhttps://patchthecve.com/cve/CVE-2025-56435.htmlWed, 17 Jun 2026 09:42:36 +0000MEDIUM 5.3: SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id.https://patchthecve.com/cve/CVE-2025-55422.htmlhttps://patchthecve.com/cve/CVE-2025-55422.htmlSun, 05 Jul 2026 02:16:56 +0000HIGH 8.8: In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.https://patchthecve.com/cve/CVE-2025-55409.htmlhttps://patchthecve.com/cve/CVE-2025-55409.htmlSun, 05 Jul 2026 02:16:56 +0000HIGH 8.8: FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code.https://patchthecve.com/cve/CVE-2025-55420.htmlhttps://patchthecve.com/cve/CVE-2025-55420.htmlWed, 17 Jun 2026 09:41:43 +0000HIGH 8.8: A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected unsanitized into the HTML response. This permits execution of arbitrary JavaScript code when a logged-in user submits the malicious input.https://patchthecve.com/cve/CVE-2025-50692.htmlhttps://patchthecve.com/cve/CVE-2025-50692.htmlWed, 17 Jun 2026 09:35:19 +0000CRITICAL 9.8: FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.https://patchthecve.com/cve/CVE-2025-46154.htmlhttps://patchthecve.com/cve/CVE-2025-46154.htmlWed, 17 Jun 2026 09:25:59 +0000HIGH 8.4: Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.https://patchthecve.com/cve/CVE-2025-5155.htmlhttps://patchthecve.com/cve/CVE-2025-5155.htmlWed, 17 Jun 2026 09:47:20 +0000MEDIUM 6.3: A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/admin/controller/Article.php. The manipulation of the argument ids leads to sql injection. The attack can be launched remotely. The exploit has https://patchthecve.com/cve/CVE-2025-29181.htmlhttps://patchthecve.com/cve/CVE-2025-29181.htmlWed, 17 Jun 2026 09:05:11 +0000HIGH 7.2: FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.https://patchthecve.com/cve/CVE-2025-29180.htmlhttps://patchthecve.com/cve/CVE-2025-29180.htmlWed, 17 Jun 2026 09:05:10 +0000HIGH 7.2: In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.https://patchthecve.com/cve/CVE-2025-29306.htmlhttps://patchthecve.com/cve/CVE-2025-29306.htmlWed, 17 Jun 2026 09:05:15 +0000CRITICAL 9.8: An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.https://patchthecve.com/cve/CVE-2025-25790.htmlhttps://patchthecve.com/cve/CVE-2025-25790.htmlSun, 05 Jul 2026 01:21:29 +0000CRITICAL 9.8: An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.https://patchthecve.com/cve/CVE-2025-25789.htmlhttps://patchthecve.com/cve/CVE-2025-25789.htmlSun, 05 Jul 2026 01:21:29 +0000CRITICAL 9.8: FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.