TI-2026-61513 CVE-2026-90495 · GHSA-8vpg-vfm4-mhh5
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
Priority HIGH 70
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11.
Fengoffice
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Fengoffice records in CISA KEVNo Fengoffice vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2025-05305 CVE-2025-5877 · GHSA-8qpg-2ff4-h2q5
Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1.
TI-2025-04881 CVE-2025-5433 · GHSA-773m-9w69-4w8v
Fengoffice Feng Office index.php sql injection
Priority MEDIUM 57
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical.
TI-2026-61515 CVE-2026-90497 · GHSA-6jfr-pc8j-pp9q
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
Priority MEDIUM 56
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11.
TI-2026-61514 CVE-2026-90496 · GHSA-c37v-9fmr-fhcj
Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
Priority MEDIUM 56
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11.
TI-2019-07038 CVE-2019-9623 · GHSA-2qj8-2h5p-7r79
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec…
Priority MEDIUM 53
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.
TI-2011-03295 CVE-2011-3738 · GHSA-c5g5-4cp9-vr2j
Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct…
Priority LOW 26
Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.p…
TI-2024-05596 CVE-2024-6039 · GHSA-m5p5-4p3m-m6m5
Feng Office Workspaces sql injection
Priority LOW 25
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2.
TI-2014-04359 CVE-2014-5343 · GHSA-xxp2-cp36-7xm7
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field.
TI-2013-04885 CVE-2013-5744 · GHSA-w9vh-v7c4-q2cj
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.