CVE-2026-9608 Details
Description
A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
A stored cross-site scripting vulnerability has been identified in QianFox FoxCMS versions through 1.2.6. The issue arises from the tag management, tag group management, hotword group management, and custom hotword features, where user input is not properly validated or sanitized before being saved. This allows attackers to inject malicious HTML or JavaScript, which is executed when the content is viewed. Additionally, the application only enforces input length restrictions on the client side, leaving a gap that can be exploited to bypass these limits.
FoxCMS should implement server-side validation for input lengths and allow only safe characters. Additionally, output should be properly encoded to prevent script execution, and a Content Security Policy should be applied to reduce XSS risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/QianFox/FoxCMS/ | [email protected] | ProductSource CodeVendor |
| https://github.com/QianFox/FoxCMS/issues/2 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/818342 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365681 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365681/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| QianFox FoxCMS | <= 1.2.6 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |