CVE-2025-25789
Critical · CVSS 9.8FoxCMS — Remote Code Execution (RCE) via code injection
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-94
Description
FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
Search profile — drives PoC discovery
Symbols index()Sitemap.phpcontroller/Sitemap.php\controller\Sitemap.php
Keywords CVE-2025-25789FoxCMSFoxCMS RCEFoxCMS v1.2.5Sitemap.php RCEFoxCMS remote code executionFoxCMS-rce3
Versions: v1.2.5
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z