GHSA-c2vx-rx6x-m9wj
Medium · 6.1CVSS
6.1
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | feehi/feehicms | 2.1.1 | No fix |
| packagist | feehi/feehicms | 2.1.1 | No fix |
Related vulnerabilities
- CVE-2025-63520 Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the… Same vulnerability
- GHSA-qgc9-p7cj-jvh6 FeehiCMS fails to enforce server-side immutability Also affects feehi/feehicms
- GHSA-w756-rf26-7rmr FeehiCMS is vulnerable to reverse tabnabbing Also affects feehi/feehicms
- CVE-2025-63523 FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are… Also affects feehi/feehicms
- CVE-2025-63522 Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function Also affects feehi/feehicms
- CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-79
- CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
- CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. CWE-79