CVE-2025-56435

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-03 · updated 2026-06-17
Weakness: CWE-89

Description

SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id.

Affected products

Foxcms: through 1.2.6

References

https://www.yuque.com/g/u43151774/zhyb2o/udq6lsnv80vnhbr4/collaborator/join?token=dU5eQpE4j6zEmVuK&source=doc_collaborator

Get alerted when CVE-2025-56435 or the next vulnerability affects your stack