CVE-2026-9609 - QianFox FoxCMS Admin.php edit password recovery

Back Back to CVE browser

MEDIUM

QianFox FoxCMS Admin.php edit password recovery

Published May 27, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password recovery. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor QianFox Product FoxCMS Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -
- Version
  1.2.3
  Status
  affected
  Constraints
  -
- Version
  1.2.4
  Status
  affected
  Constraints
  -
- Version
  1.2.5
  Status
  affected
  Constraints
  -
- Version
  1.2.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QianFox

FoxCMS

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-
1.2.3	affected	-
1.2.4	affected	-
1.2.5	affected	-
1.2.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-640

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32029
Advisory
https://github.com/QianFox/FoxCMS/
product
https://github.com/QianFox/FoxCMS/issues/3
exploitissue-tracking
https://vuldb.com/submit/818343
third-party-advisory
https://vuldb.com/vuln/365682
vdb-entrytechnical-description
https://vuldb.com/vuln/365682/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32029		Advisory
https://github.com/QianFox/FoxCMS/		product
https://github.com/QianFox/FoxCMS/issues/3		exploitissue-tracking
https://vuldb.com/submit/818343		third-party-advisory
https://vuldb.com/vuln/365682		vdb-entrytechnical-description
https://vuldb.com/vuln/365682/cti		signaturepermissions-required