Vulnerabilities

Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Gr…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00219 Published 2026-04-06 No fix listed CWE-79

TI-2026-23934 CVE-2026-31353 · GHSA-664p-j3q6-p843

An authenticated stored cross-site scripting (XSS) vulnerability in the Category module…

MEDIUM 58

An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name paramete…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00176 Published 2026-04-06 No fix listed CWE-79

TI-2026-23933 CVE-2026-31352 · GHSA-hqjc-wfvx-x2fv

An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management…

MEDIUM 58

An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Role N…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00219 Published 2026-04-06 No fix listed CWE-79

TI-2026-23932 CVE-2026-31351 · GHSA-cvjh-88c8-2jjx

An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing…

LOW 21

An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00188 Published 2026-04-06 No fix listed CWE-79

TI-2026-23931 CVE-2026-31350 · GHSA-cgxr-v74v-g9mm

An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1…

MEDIUM 58

An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Page Sign parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00176 Published 2026-04-06 No fix listed CWE-79

TI-2026-23929 CVE-2026-31313 · GHSA-hj9c-p59c-vqph

An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing…

MEDIUM 58

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00138 Published 2026-04-06 No fix listed CWE-79

TI-2025-13939 CVE-2025-15264 · GHSA-4g6x-74c2-rfr9

FeehiCMS TimThumb timthumb.php server-side request forgery

HIGH 70

A vulnerability was determined in FeehiCMS up to 2.1.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00403 Published 2025-12-30 No fix listed CWE-918

TI-2025-40416 CVE-2025-65657 · GHSA-mcxq-54f4-mmx5

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad…

HIGH 70

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00425 Published 2025-12-02 No fix listed CWE-77

TI-2025-39351 CVE-2025-63523 · GHSA-qgc9-p7cj-jvh6

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are…

MEDIUM 62

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend ac…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00282 Published 2025-12-01 No fix listed CWE-125

TI-2025-39350 CVE-2025-63522 · GHSA-w756-rf26-7rmr

Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

MEDIUM 54

Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00211 Published 2025-12-01 No fix listed CWE-1021

TI-2025-39349 CVE-2025-63520 · GHSA-c2vx-rx6x-m9wj

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00258 Published 2025-12-01 No fix listed CWE-79

TI-2024-07691 CVE-2024-8296 · GHSA-xp68-7g33-f49m

FeehiCMS index.php insert unrestricted upload

MEDIUM 57

A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2024-07690 CVE-2024-8295 · GHSA-3wrg-6mg5-jg2v

FeehiCMS index.php createBanner unrestricted upload

MEDIUM 57

A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2024-07689 CVE-2024-8294 · GHSA-xxqw-83c7-r24r

FeehiCMS index.php update unrestricted upload

MEDIUM 57

A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00756 Published 2024-08-29 No fix listed CWE-434

TI-2020-14066 CVE-2020-21489 · GHSA-6vf2-mfmr-qqqw

File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute…

MEDIUM 52

File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01314 Published 2023-06-20 Fixed in 2.0.8.1 CWE-434

TI-2020-14010 CVE-2020-21174 · GHSA-q3q5-qvh5-cmw5

File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute…

MEDIUM 52

File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01314 Published 2023-06-20 Fixed in 2.0.8.1 CWE-434

TI-2022-19175 CVE-2022-40373 · GHSA-xv8h-43h9-v3jq

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18941 CVE-2022-40002 · GHSA-6vh6-72g6-xqx2

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18940 CVE-2022-40001 · GHSA-gqgq-784q-v9xp

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2022-18939 CVE-2022-40000 · GHSA-8vjp-hfgh-68rj

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2022-12-15 No fix listed CWE-79

TI-2021-14808 CVE-2021-36573 · GHSA-67mh-hw8v-x8v9

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.

MEDIUM 58

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-12-15 No fix listed CWE-79

TI-2021-14807 CVE-2021-36572 · GHSA-m54v-gv8p-9pqp

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2022-12-15 No fix listed CWE-79

TI-2020-18805 CVE-2020-36607 · GHSA-6jj8-mqx2-7fg5

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run…

HIGH 68

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-12-15 No fix listed CWE-79