high7.2
CVE-2025-29180
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability.
Impact
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Foxcms | Foxcms | through 1.25 |