qianfox FoxCMS CVE-2025-11306

Q: What is the CVSS score of CVE-2025-11306?

CVE-2025-11306 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-10-05 cna@vuldb.com

PHP XSS Foxcms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:00 vuln.today

DescriptionCVE.org

A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Reflected cross-site scripting (XSS) in qianfox FoxCMS up to version 1.2 allows remote unauthenticated attackers to inject malicious JavaScript through the keyword parameter in the Search Page component (/index.php/Search). The vulnerability requires user interaction (clicking a malicious link) and results in integrity impact via session hijacking or credential theft. Exploit code is publicly available on GitHub, though EPSS scoring (0.03%) suggests limited real-world exploitation activity.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in a PHP-based content management system. The Search Page component fails to properly sanitize or encode user-supplied input in the keyword parameter before reflecting it back in the HTTP response. Reflected XSS occurs when untrusted input is immediately echoed to the user without validation, allowing attackers to execute arbitrary JavaScript in the victim's browser within the context of the affected application. The vulnerability affects qianfox FoxCMS versions up to 1.2, a PHP application designed for content management.

RemediationAI

No vendor-released patch is available - the vendor did not respond to early disclosure contact. Organizations using FoxCMS 1.2 should implement compensating controls: deploy a Web Application Firewall (WAF) with rules to detect and block reflected XSS payloads in the keyword parameter (e.g., ModSecurity rules for detecting script tags or JavaScript event handlers); apply input validation and output encoding at the application level by manually modifying /index.php/Search to sanitize the keyword parameter using PHP's htmlspecialchars() or equivalent encoding functions; restrict access to the Search functionality to authenticated users only via .htaccess or application logic; implement a Content Security Policy (CSP) header to prevent inline script execution even if XSS succeeds. Consider upgrading to a maintained CMS alternative if security patching is critical for your deployment. Verify any fixes with the FoxCMS project community or fork if active maintenance is needed.