A flaw in the FoxCMS administration module permits manipulation of the Edit function in Admin.php, resulting in weak password recovery capabilities. This weakness, classified as CWE-640, allows an attacker to easily reset or recover administrator passwords, thereby bypassing authentication controls. The impact is that unauthorized individuals could gain privileged access to the CMS, compromising the system’s confidentiality and integrity.

The vulnerability affects QianFox’s FoxCMS platform up to version 1.2.6. Deployments running any of these releases are susceptible; later releases (if available) are not covered by the advisory.

The CVSS score of 5.1 indicates a moderate severity risk. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the description notes that the exploit is publicly available and could be employed remotely. Attackers can trigger the weakness simply by sending manipulated requests to the Admin.php edit password recovery endpoint, potentially without prior authentication. Overall, the risk remains moderate but could be elevated if no mitigation is applied.