CVE-2026-9608

LowCVSS 2.4/10Last modified Jul 24, 2026

Description

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-96094.7A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads t CVE-2026-960969.8Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.CVE-2026-96105.3IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked i CVE-2026-961087.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-961139.8Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.CVE-2026-961187.8Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-961199.9IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the sy CVE-2026-96125.3The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to CVE-2026-96134.3The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi CVE-2026-96148.8An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain a CVE-2026-96154.3The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the li CVE-2026-96164.3The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is d