CVE-2025-25789: Foxcms

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.

Affected products

• Foxcms Foxcms: version 1.2.5 only

Published 2025-02-26. Last modified 2026-07-05.