CVE-2025-55420

A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected unsanitized into the HTML response. This permits execution of arbitrary JavaScript code when a logged-in user submits the malicious input.

• CWE-79

• https://www.notion.so/FoxCMS-V1-2-6-Reflected-XSS-in-index-php-2222b2fd021080589d27ef8e1b9ebd86?source=copy_linkExploit, Third Party Advisory

Published

Aug 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5539The Simple Contact Form Plugin for WordPress – WP Easy Conta…6.4
• CVE-2025-55398An issue was discovered in mouse07410 asn1c thru 0.9.29 (202…9.8
• CVE-2025-5540The Event RSVP and Simple Event Management Plugin plugin for…5.4
• CVE-2025-55409FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability …8.8
• CVE-2025-5541The Runners Log plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-5542A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726…4.8
• CVE-2025-55422In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (…8.8
• CVE-2025-55423A command injection vulnerability exists in the upnp_relay()…9.8
• CVE-2025-5543A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726…4.8
• CVE-2025-5544A vulnerability was found in aaluoxiang oa_system up to 5b44…7.5
• CVE-2025-55443Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive ad…9.1
• CVE-2025-55444A SQL injection vulnerability exists in the id2 parameter of…9.8