This vulnerability in QianFox FoxCMS (up to version 1.2.6) involves the Edit function within the Admin.php file, which can be manipulated remotely to weaken the password recovery process. The weakness allows attackers with high privileges to initiate password recovery attacks remotely, potentially compromising account security. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official patch or remediation guidance has been provided by the vendor as of the publication date.

The vulnerability allows remote attackers to exploit weak password recovery functionality, potentially enabling unauthorized password resets or account access. The impact is limited to confidentiality, integrity, and availability at a low level, and requires high privileges to initiate the attack. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the affected Admin.php functionality to trusted administrators only and consider additional controls around password recovery processes to reduce risk.