CVE-2025-25790

Critical CVSS: 9.8

An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.

Vendor

Foxcms

Product

Foxcms

CWE

CWE-434

Yayın Tarihi

2025-02-26 15:15:26

Güncelleme

2025-04-09 14:08:49

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-434 Foxcms CRITICAL Foxcms 2025

Referanslar

http://foxcms.com https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-upload-rce.md https://www.foxcms.cn/ https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-upload-rce.md

Benzer Kayıtlar

Medium

CVE-2025-12920

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the fil…

Medium

CVE-2025-10251

A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/adm…

High

CVE-2025-56630

FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Colum…

Medium

CVE-2025-56435

SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file…

High

CVE-2025-55422

In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.

High

CVE-2025-55409

FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbi…