CVE-2025-63520
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Dec 1, 2025
CISA due date
—
The record
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | feehi/feehicms | 2.1.1 | No fix |
| packagist | feehi/feehicms | 2.1.1 | No fix |
Related vulnerabilities
- GHSA-c2vx-rx6x-m9wj FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update… Same vulnerability
- GHSA-qgc9-p7cj-jvh6 FeehiCMS fails to enforce server-side immutability Also affects feehi/feehicms
- GHSA-w756-rf26-7rmr FeehiCMS is vulnerable to reverse tabnabbing Also affects feehi/feehicms
- CVE-2025-63523 FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are… Also affects feehi/feehicms
- CVE-2025-63522 Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function Also affects feehi/feehicms