CVE-2025-12920: qianfox FoxCMS Product.php edit cross site scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-09 · updated 2026-10-18
Weakness: CWE-79

Description

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Foxcms: through 1.2.16

References

https://github.com/21151213732/CVE/blob/main/FoxCMS-XSS2.md
https://github.com/21151213732/CVE/blob/main/FoxCMS-XSS3.md
https://vuldb.com/?ctiid.331640
https://vuldb.com/?id.331640
https://vuldb.com/?submit.680851
https://vuldb.com/?submit.680852
https://vuldb.com/?submit.680853
https://github.com/21151213732/CVE/blob/main/FoxCMS-XSS2.md
https://github.com/21151213732/CVE/blob/main/FoxCMS-XSS3.md

Get alerted when CVE-2025-12920 or the next vulnerability affects your stack