Vulnerabilidades de Feehi
CVEs publicadas que afetam produtos de Feehi: 13 registro(s), com severidade, exploração e correções.
CVE-2026-13546
Alta · 7.3
CWE-287 29/06/2026
Feehi CMS REST API Endpoint articles missing authentication
A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-13544
Média · 6.3
CWE-266 29/06/2026
Feehi CMS API users access control
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-31313
Média · 5.4
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Content field.
CVE-2026-31354
Média · 5.4
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Group, Category or Description parameters.
CVE-2026-31353
Média · 5.4
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVE-2026-31352
Média · 5.4
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Role Name parameter.
CVE-2026-31351
Média · 4.8
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
CVE-2026-31350
Média · 5.4
CWE-79 06/04/2026
Cross-site Scripting (XSS) em Feehi Feehi Cms
An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Page Sign parameter.
CVE-2025-15264
Alta · 7.3
CWE-918 30/12/2025
FeehiCMS TimThumb timthumb.php server-side request forgery
A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Executing manipulation of the argument src can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-65657
Média · 6.5
CWE-77 02/12/2025
Command Injection em Feehi Feehi Cms
FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
CVE-2025-63523
Média · 6.5
CWE-125 01/12/2025
Out-of-bounds Read em Feehi Feehi Cms
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
CVE-2025-63522
Média · 4.6
CWE-1021 01/12/2025
Clickjacking em Feehi Feehi Cms
Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function
CVE-2025-63520
Média · 6.1
CWE-79 01/12/2025
Cross-site Scripting (XSS) em Feehi Feehi Cms
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).