CVE-2026-9609

MediumCVSS 4.7

Published: 27/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

In QianFox FoxCMS up to version 1.2.6, a vulnerability was found in the Edit function of Admin.php, allowing manipulation of the password recovery process. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

The organization is at risk of unauthorized password recovery by an attacker, potentially leading to admin account takeover.

Recommendation

Immediately update FoxCMS to the latest available version or apply temporary mitigations if the vendor has not yet released a patch.

Other vulnerabilities in QianFox FoxCMS

CVE-2025-11306Medium
A cross-site scripting (XSS) vulnerability was found in qianfox FoxCMS up to version 1.2 in the /index.php/Search file, in the Search Page component. Manipulation of the keyword argument allows remote exploitation. The exploit has been made public, and the vendor did not respond.

Original NVD description (English source)

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS