Qianfox
Qianfox Foxcms: vulnerabilidades y CVE
Qianfox Foxcms tiene 12 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses3
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-9609 | Baja (2) | 0.38% | — | 27 may 2026 | A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is… |
| CVE-2026-9608 | Baja (1.9) | 0.35% | — | 27 may 2026 | A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site… |
| CVE-2025-11306 | Baja (2.1) | 0.34% | — | 5 oct 2025 | A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting.… |
| CVE-2025-51650 | Media (5.6) | 0.27% | — | 14 jul 2025 | An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file. |
| CVE-2025-7568 | Baja (2.1) | 0.40% | — | 14 jul 2025 | A vulnerability was found in qianfox FoxCMS up to 1.2.5. It has been classified as critical. Affected is the function batchCope of the file app/admin/controller/Video.php. The manipulation of the argument ids leads to… |
| CVE-2025-6094 | Baja (2.1) | 0.45% | — | 15 jun 2025 | A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument… |
| CVE-2025-45239 | Media (5.3) | 0.72% | — | 5 may 2025 | An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. |
| CVE-2025-45238 | Crítica (9.1) | 0.67% | — | 5 may 2025 | foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. |
| CVE-2025-45240 | Media (6.5) | 0.31% | — | 5 may 2025 | foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php. |
| CVE-2025-2653 | Media (5.3) | 0.32% | — | 23 mar 2025 | A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The… |
| CVE-2024-12901 | Media (6.9) | 0.63% | — | 23 dic 2024 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation… |
| CVE-2024-12900 | Media (5.3) | 0.75% | — | 23 dic 2024 | A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.