Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Sep 6, 2026A weakness has been identified in liufee FeehiCMS up to 2.1.1.CVE-2026-86241 · Other software · liufee · reported by VulDBLow 2.1
A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A security flaw has been discovered in liufee FeehiCMS up to 2.1.1.CVE-2026-86240 · Other software · liufee · reported by VulDBLow 2
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2026A vulnerability was identified in liufee FeehiCMS up to 2.1.1.CVE-2026-86239 · Other software · liufee · reported by VulDBMedium 5.5
A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler componentsCVE-2026-51953 · Other software · reported by MITREHigh 7.4
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025A vulnerability was determined in FeehiCMS up to 2.1.1.CVE-2025-15264 · Other software · Feehi · reported by VulDBMedium 5.5
A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Executing manipulation of the argument src can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management.CVE-2025-65657 · Other software · Feehi · reported by MITREMedium 6.5
FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can inteCVE-2025-63523 · Other software · Feehi · reported by MITREMedium 6.5
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management functionCVE-2025-63522 · Other software · Feehi · reported by MITREMedium 4.6
Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).CVE-2025-63520 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical.CVE-2024-8296 · Other software · feehi · reported by VulDBMedium 5.3
A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument User[avatar] leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical.CVE-2024-8295 · Other software · feehi · reported by VulDBMedium 5.3
A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. This vulnerability affects the function createBanner of the file /admin/index.php?r=banner%2Fbanner-create. The manipulation of the argument BannerForm[img] leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1.CVE-2024-8294 · Other software · feehi · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/index.php?r=friendly-link%2Fupdate. The manipulation of the argument FriendlyLink[image] leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.CVE-2020-21489 · Other software · Feehi · reported by MITRECritical 9.8
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.CVE-2020-21174 · Other software · Feehi · reported by MITRECritical 9.8
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.CVE-2022-40373 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.CVE-2022-40002 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.CVE-2022-40001 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.CVE-2022-40000 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.CVE-2021-36573 · Other software · Feehi · reported by MITREMedium 5.4
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.CVE-2021-36572 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.CVE-2020-36607 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.CVE-2020-20589 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022A vulnerability, which was classified as problematic, has been found in FeehiCMS.CVE-2022-4014 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The identifier of this vulnerability is VDB-213788.
- Product
- FeehiCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.CVE-2022-43320 · Other software · Feehi · reported by MITREMedium 6.1
FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page mCVE-2022-40408 · Other software · Feehi · reported by MITREMedium 5.4
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.CVE-2020-21516 · Other software · Feehi · reported by MITRECritical 9.8
There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.CVE-2020-21322 · Other software · Feehi · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.CVE-2020-19709 · Other software · Feehi · reported by MITREMedium 6.1
Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.