Read the docs
TI-2013-04885 Aliases CVE-2013-5744GHSA-w9vh-v7c4-q2cj

Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows…

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.

Why it matters now

EPSS 0.0096 61st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 46

CPEVersionsRoleVendor
cpe:2.3:a:fengoffice:feng_office:*:rc:*:*:*:*:*:*up to 2.3.2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:*:*:*:*:*:*:*1.7VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:beta:*:*:*:*:*:*1.7 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:beta2:*:*:*:*:*:*1.7 beta2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:rc:*:*:*:*:*:*1.7 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:rc2:*:*:*:*:*:*1.7 rc2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7:rc3:*:*:*:*:*:*1.7 rc3VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableFengoffice
  • cpe:2.3:a:fengoffice:feng_office:*:rc:*:*:*:*:*:* Versions up to 2.3.2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:beta:*:*:*:*:*:* Versions 1.7 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:beta2:*:*:*:*:*:* Versions 1.7 beta2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:rc:*:*:*:*:*:* Versions 1.7 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:rc2:*:*:*:*:*:* Versions 1.7 rc2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7:rc3:*:*:*:*:*:* Versions 1.7 rc3 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Fengoffice
Show 36 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:fengoffice:feng_office:1.7.3.1:*:*:*:*:*:*:*1.7.3.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.5:beta:*:*:*:*:*:*1.7.5 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.5:rc2:*:*:*:*:*:*1.7.5 rc2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:1.7.5:rc3:*:*:*:*:*:*1.7.5 rc3VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:beta4:*:*:*:*:*:*2.0.0 beta4VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.0.0:rc:*:*:*:*:*:*2.0.0 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.1.0:beta:*:*:*:*:*:*2.1.0 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.1.0:rc:*:*:*:*:*:*2.1.0 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.1.0:rc2:*:*:*:*:*:*2.1.0 rc2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.0:beta:*:*:*:*:*:*2.2.0 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.0:rc:*:*:*:*:*:*2.2.0 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.1:rc:*:*:*:*:*:*2.2.1 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.3.1:*:*:*:*:*:*:*2.2.3.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.3.1:beta:*:*:*:*:*:*2.2.3.1 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.4:beta:*:*:*:*:*:*2.2.4 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.2.4.1:*:*:*:*:*:*:*2.2.4.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3:*:*:*:*:*:*:*2.3VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3:beta:*:*:*:*:*:*2.3 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3:rc:*:*:*:*:*:*2.3 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3:rc2:*:*:*:*:*:*2.3 rc2VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3.1:beta:*:*:*:*:*:*2.3.1 betaVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3.1:rc:*:*:*:*:*:*2.3.1 rcVulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3.1.1:*:*:*:*:*:*:*2.3.1.1VulnerableFengoffice
cpe:2.3:a:fengoffice:feng_office:2.3.2:beta:*:*:*:*:*:*2.3.2 betaVulnerableFengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.3.1:*:*:*:*:*:*:* Versions 1.7.3.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.5:beta:*:*:*:*:*:* Versions 1.7.5 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.5:rc2:*:*:*:*:*:* Versions 1.7.5 rc2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:1.7.5:rc3:*:*:*:*:*:* Versions 1.7.5 rc3 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.0.0:rc:*:*:*:*:*:* Versions 2.0.0 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.1.0:beta:*:*:*:*:*:* Versions 2.1.0 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.1.0:rc:*:*:*:*:*:* Versions 2.1.0 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.1.0:rc2:*:*:*:*:*:* Versions 2.1.0 rc2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.0:beta:*:*:*:*:*:* Versions 2.2.0 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.0:rc:*:*:*:*:*:* Versions 2.2.0 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.1:rc:*:*:*:*:*:* Versions 2.2.1 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.3.1:*:*:*:*:*:*:* Versions 2.2.3.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.3.1:beta:*:*:*:*:*:* Versions 2.2.3.1 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.4:beta:*:*:*:*:*:* Versions 2.2.4 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.2.4.1:*:*:*:*:*:*:* Versions 2.2.4.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3:beta:*:*:*:*:*:* Versions 2.3 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3:rc:*:*:*:*:*:* Versions 2.3 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3:rc2:*:*:*:*:*:* Versions 2.3 rc2 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3.1:beta:*:*:*:*:*:* Versions 2.3.1 beta Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3.1:rc:*:*:*:*:*:* Versions 2.3.1 rc Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3.1.1:*:*:*:*:*:*:* Versions 2.3.1.1 Vulnerable ·Fengoffice
  • cpe:2.3:a:fengoffice:feng_office:2.3.2:beta:*:*:*:*:*:* Versions 2.3.2 beta Vulnerable ·Fengoffice

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-5744
  2. 2026-10-03 Alias added: GHSA-w9vh-v7c4-q2cj

References

Exploit 2

  • TI-2025-05305 Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference CVSS 4.0MEDIUM 5.3
  • TI-2019-07038 Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec… CVSS 3.0CRITICAL 9.8
  • TI-2011-03295 Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct… CVSS 2.0MEDIUM 5.0
  • TI-2024-05596 Feng Office Workspaces sql injection CVSS 4.0MEDIUM 5.3
  • TI-2014-04359 Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences