Description
A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-365682 | QianFox FoxCMS Admin.php edit password recovery
https://vuldb.com/vuln/365682
Signature, Permissions Required signature
permissions-required
VDB-365682 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365682/cti
Third Party Advisory third-party-advisory
Submit #818343 | QianFox FoxCMS 1.2.6 Improper Privilege Management
https://vuldb.com/submit/818343
Exploit exploit
issue-tracking
https://github.com/QianFox/FoxCMS/issues/3
Product product
https://github.com/QianFox/FoxCMS/
Scores
CVSS v3
4.7
EPSS
0.0022
EPSS Percentile
12.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-640
Status
published
Products (7)
QianFox/FoxCMS
1.2.0
QianFox/FoxCMS
1.2.1
QianFox/FoxCMS
1.2.2
QianFox/FoxCMS
1.2.3
QianFox/FoxCMS
1.2.4
QianFox/FoxCMS
1.2.5
QianFox/FoxCMS
1.2.6
Published
May 27, 2026
Tracked Since
May 27, 2026