Vulnerabilidades do Qianfox Foxcms
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Qianfox Foxcms: 4 registro(s), com versões afetadas e correções.cpe:2.3:a:qianfox:foxcms
CVE-2026-9609
Média · 4.7
CWE-640 26/05/2026
QianFox FoxCMS Admin.php edit password recovery
A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-9608
Baixa · 2.4
CWE-79 26/05/2026
QianFox FoxCMS Administrator Backend edit cross site scripting
A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-12920
Média · 4.8
CWE-79 09/11/2025
qianfox FoxCMS Product.php edit cross site scripting
A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-11306
Média · 6.1
CWE-79 05/10/2025
qianfox FoxCMS Search cross site scripting
A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.