Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Oct 5, 2026Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint.CVE-2026-95265 · Other software · reported by MITREHigh 7.5
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Feehi CMS 2.1.1 is vulnerable to Directory Traversal.CVE-2026-95264 · Other software · reported by MITREMedium 6.5
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control.CVE-2026-95263 · Other software · reported by MITREHigh 7.2
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not require the old password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026A vulnerability was found in Feehi CMS up to 2.1.1.CVE-2026-13546 · Other software · Feehi · reported by VulDBMedium 5.5
A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026A flaw has been found in Feehi CMS up to 2.1.1.CVE-2026-13544 · Other software · Feehi · reported by VulDBLow 2.1
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scCVE-2026-31313 · Other software · Feehi · reported by MITREMedium 5.4
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Content field.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary webCVE-2026-31354 · Other software · Feehi · reported by MITREMedium 5.4
Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Group, Category or Description parameters.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts orCVE-2026-31353 · Other software · Feehi · reported by MITREMedium 5.4
An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scrCVE-2026-31352 · Other software · Feehi · reported by MITREMedium 5.4
An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Role Name parameter.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scCVE-2026-31351 · Other software · Feehi · reported by MITREMedium 4.8
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a cCVE-2026-31350 · Other software · Feehi · reported by MITREMedium 5.4
An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Page Sign parameter.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.CVE-2021-36573 · Other software · Feehi · reported by MITREMedium 5.4
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.CVE-2021-36572 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header.CVE-2022-38796 · Other software · Feehi · reported by MITREMedium 6.1
A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comyoutube.com
Jul 27, 2022A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML viCVE-2022-34140 · Other software · Feehi · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 26, 2022An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP filCVE-2022-34971 · Other software · Feehi · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.CVE-2020-21322 · Other software · Feehi · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability.CVE-2021-30108 · Other software · Feehi · reported by MITRECritical 9.1
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution.CVE-2020-22643 · Other software · Feehi · reported by MITREHigh 7.2
Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability.CVE-2020-21146 · Other software · Feehi · reported by MITREMedium 6.1
Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.
- Product
- Feehi CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.