{"id":"CVE-2025-2653","aliases":["EUVD-2025-15106","GHSA-hj88-g9rf-7f79"],"status":"published","title":"FoxCMS improper authorization","description":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00329,"percentile":0.26329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266","CWE-285"],"published":"2025-03-23T15:31:10Z","modified":"2026-06-17T09:07:22Z","products":[{"vendor":"qianfox","product":"foxcms"}],"references":[{"url":"https://vuldb.com/?id.300668","tags":["vdb-entry","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.300668","tags":["signature","permissions-required","Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?submit.519927","tags":["third-party-advisory","Third Party Advisory","VDB Entry"]},{"url":"https://www.yuque.com/yuqueyonghuveuwuh/aveeid/nvg6rd3qw1ww83yo?singleDoc","tags":["broken-link","exploit","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2653"},{"url":"https://github.com/advisories/GHSA-hj88-g9rf-7f79"}],"sources":{"cve":[{"id":"CVE-2025-2653","title":"FoxCMS improper authorization","description":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-23T15:31:10.397Z","modified":"2025-03-24T12:18:51.439Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","assessor":"cna"}],"cwes":["CWE-285","CWE-266"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-15106","description":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-23T15:31:10Z","modified":"2025-03-24T12:18:51Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:55.116366Z"}],"ghsa":[{"id":"GHSA-hj88-g9rf-7f79","title":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is...","description":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-23T18:30:28Z","modified":"2025-03-23T18:30:29Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:00:24.759183Z"}],"nvd":[{"id":"CVE-2025-2653","description":"A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.","status":"published","published":"2025-03-23T16:15:13.24Z","modified":"2026-06-17T09:07:22.483Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-266","CWE-285"],"updated_at":"2026-11-02T14:10:54.744127Z"}]}}