CVE-2025-11306
qianfox FoxCMS Search cross site scripting
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 5, 2025
- Updated
- Feb 24, 2026
- Reserved
- Oct 4, 2025
Description
A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
FoxCMSqianfox |
|
References
- VDB-327187 | qianfox FoxCMS Search cross site scriptingvdb-entrytechnical-description
- VDB-327187 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #661874 | Guizhou Qianhu Technology Co., Ltd. FoxCMS ≤ v1.2 Reflected Cross-Site Scripting (Reflected XSS, CWE-79)third-party-advisory
- https://github.com/coolcj-stack/FoxCMS-V1.2-is-vulnerable-to-cross-site-scripting-attacks.-There-is-an-XSS-vulnerabilityexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.