CVE-2025-11306

MediumCVSS 4.3

Published: 05/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in qianfox FoxCMS up to version 1.2 in the /index.php/Search file, in the Search Page component. Manipulation of the keyword argument allows remote exploitation. The exploit has been made public, and the vendor did not respond.

Risk Assessment

An attacker can inject malicious scripts, potentially leading to user data theft or session hijacking.

Recommendation

Apply input filtering for the keyword argument and consider updating or replacing the system if the vendor does not provide fixes.

Other vulnerabilities in qianfox FoxCMS

CVE-2026-9609Medium
In QianFox FoxCMS up to version 1.2.6, a vulnerability was found in the Edit function of Admin.php, allowing manipulation of the password recovery process. The attack can be performed remotely, and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS