TI-2026-61515 CVE-2026-90497 · GHSA-6jfr-pc8j-pp9q
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
Priority MEDIUM 56
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11.
Vulnerabilities
10 records
TI-2026-61514 CVE-2026-90496 · GHSA-c37v-9fmr-fhcj
Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
Priority MEDIUM 56
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11.
TI-2026-61513 CVE-2026-90495 · GHSA-8vpg-vfm4-mhh5
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
Priority HIGH 70
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11.
TI-2025-05305 CVE-2025-5877 · GHSA-8qpg-2ff4-h2q5
Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1.
TI-2025-04881 CVE-2025-5433 · GHSA-773m-9w69-4w8v
Fengoffice Feng Office index.php sql injection
Priority MEDIUM 57
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical.
TI-2024-05596 CVE-2024-6039 · GHSA-m5p5-4p3m-m6m5
Feng Office Workspaces sql injection
Priority LOW 25
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2.
TI-2019-07038 CVE-2019-9623 · GHSA-2qj8-2h5p-7r79
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec…
Priority MEDIUM 53
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.
TI-2014-04359 CVE-2014-5343 · GHSA-xxp2-cp36-7xm7
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field.
TI-2013-04885 CVE-2013-5744 · GHSA-w9vh-v7c4-q2cj
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.
TI-2011-03295 CVE-2011-3738 · GHSA-c5g5-4cp9-vr2j
Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct…
Priority LOW 26
Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.p…