FoxCMS vulnerabilities
We track 5 vulnerabilities in FoxCMS products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2025.
Latest FoxCMS vulnerabilities
- 9.8 Critical severity
FoxCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The e
- 8.8 High severity
Foxcms: Improper Neutralization of Input During Web Page Generation
A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected unsanitized into the HTML response. This permits execution of arbitrary JavaScript code when a logge
- 7.2 High severity
Foxcms: Improper Neutralization of Special Elements used in an SQL Command
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
- 9.8 Critical severity
Foxcms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- 9.8 Critical severity
FoxCMS: Improper Control of Generation of Code
A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injectio