CVE-2025-63523
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Dec 1, 2025
CISA due date
—
The record
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | feehi/feehicms | 2.1.1 | No fix |
| packagist | feehi/feehicms | 2.1.1 | No fix |
Related vulnerabilities
- GHSA-qgc9-p7cj-jvh6 FeehiCMS fails to enforce server-side immutability Same vulnerability
- GHSA-c2vx-rx6x-m9wj FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update… Also affects feehi/feehicms
- GHSA-w756-rf26-7rmr FeehiCMS is vulnerable to reverse tabnabbing Also affects feehi/feehicms
- CVE-2025-63520 Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the… Also affects feehi/feehicms
- CVE-2025-63522 Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function Also affects feehi/feehicms