Vulnerabilities

TI-2025-13939 CVE-2025-15264 · GHSA-4g6x-74c2-rfr9

FeehiCMS TimThumb timthumb.php server-side request forgery

HIGH 70

A vulnerability was determined in FeehiCMS up to 2.1.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00403 Published 2025-12-30 No fix listed CWE-918

TI-2025-40416 CVE-2025-65657 · GHSA-mcxq-54f4-mmx5

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad…

HIGH 70

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00425 Published 2025-12-02 No fix listed CWE-77

TI-2025-39351 CVE-2025-63523 · GHSA-qgc9-p7cj-jvh6

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are…

MEDIUM 62

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend ac…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00282 Published 2025-12-01 No fix listed CWE-125

TI-2025-39350 CVE-2025-63522 · GHSA-w756-rf26-7rmr

Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

MEDIUM 54

Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00211 Published 2025-12-01 No fix listed CWE-1021

TI-2025-39349 CVE-2025-63520 · GHSA-c2vx-rx6x-m9wj

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00258 Published 2025-12-01 No fix listed CWE-79

TI-2024-07691 CVE-2024-8296 · GHSA-xp68-7g33-f49m

FeehiCMS index.php insert unrestricted upload

MEDIUM 57

A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2024-07690 CVE-2024-8295 · GHSA-3wrg-6mg5-jg2v

FeehiCMS index.php createBanner unrestricted upload

MEDIUM 57

A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2024-07689 CVE-2024-8294 · GHSA-xxqw-83c7-r24r

FeehiCMS index.php update unrestricted upload

MEDIUM 57

A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2020-14066 CVE-2020-21489 · GHSA-6vf2-mfmr-qqqw

File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute…

MEDIUM 52

File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01314 Published 2023-06-20 Fixed in 2.0.8.1 CWE-434

TI-2020-14010 CVE-2020-21174 · GHSA-q3q5-qvh5-cmw5

File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute…

MEDIUM 52

File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01314 Published 2023-06-20 Fixed in 2.0.8.1 CWE-434

TI-2022-19175 CVE-2022-40373 · GHSA-xv8h-43h9-v3jq

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18941 CVE-2022-40002 · GHSA-6vh6-72g6-xqx2

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18940 CVE-2022-40001 · GHSA-gqgq-784q-v9xp

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18939 CVE-2022-40000 · GHSA-8vjp-hfgh-68rj

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2021-14808 CVE-2021-36573 · GHSA-67mh-hw8v-x8v9

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.

MEDIUM 58

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-12-15 No fix listed CWE-79

TI-2021-14807 CVE-2021-36572 · GHSA-m54v-gv8p-9pqp

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2022-12-15 No fix listed CWE-79

TI-2020-18805 CVE-2020-36607 · GHSA-6jj8-mqx2-7fg5

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run…

HIGH 68

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-12-15 No fix listed CWE-79

TI-2020-13880 CVE-2020-20589 · GHSA-pwh3-3pcm-6vjh

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00611 Published 2022-12-15 No fix listed CWE-79

TI-2022-03683 CVE-2022-4014 · GHSA-cjp8-vv38-p3g2

FeehiCMS Post My Comment Tab cross-site request forgery

LOW 19

A vulnerability, which was classified as problematic, has been found in FeehiCMS.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00222 Published 2022-11-16 No fix listed CWE-863

TI-2022-21148 CVE-2022-43320 · GHSA-3ppm-fwhm-qqg6

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0049 Published 2022-11-09 No fix listed CWE-79

TI-2022-19181 CVE-2022-40408 · GHSA-5mqq-7g25-r4wx

FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via…

MEDIUM 58

FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00506 Published 2022-09-29 No fix listed CWE-79

TI-2020-14077 CVE-2020-21516 · GHSA-jj62-mc3m-j769

There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image…

MEDIUM 45

There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01273 Published 2022-09-06 Fixed in 2.0.8.1 CWE-434

TI-2020-14028 CVE-2020-21322 · GHSA-rf3w-29h3-r636

An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to…

MEDIUM 46

An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01781 Published 2021-09-15 Fixed in 2.0.8.1 CWE-434

TI-2020-13685 CVE-2020-19709 · GHSA-f8pv-x7h8-687v

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to…

LOW 28

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2021-08-26 No fix listed CWE-79

Vulnerabilities

Filters