A vulnerability classified as critical was found in FoxCMS up to 1.24. Affected by this issue is the function
batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection.
This vulnerability is known as CVE-2025-10251. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
