CVE-2024-12901

CVE-2024-12901 is a critical improper authorization vulnerability affecting FoxCMS up to version 1.2, specifically within the API Endpoint component's Site.php file. An unauthenticated attacker can remotely manipulate the 'password' argument, leading to unauthorized access or actions. While the CVSS score is a medium 5.3, the exploit has been publicly disclosed, increasing the risk. Despite public disclosure, there is currently no evidence of active exploitation, readily available exploit frameworks like Metasploit or Nuclei, or significant community discussion or media coverage.