liufee/cms

GitHub

github.com

demo.cms.feehi.com

Releases40

Frequency1 month 1 week

Last Release almost 6 years ago

Stars530

Feehi CMS based on yii2

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-31313 ↗	Apr 6, 2026Monday, 6 April 2026, 17:17	5.4 MEDIUM	—
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Content field.
CVE-2026-31354 ↗	Apr 6, 2026Monday, 6 April 2026, 16:16	5.4 MEDIUM	—
Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Group, Category or Description parameters.
CVE-2026-31353 ↗	Apr 6, 2026Monday, 6 April 2026, 16:16	5.4 MEDIUM	—
An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVE-2026-31352 ↗	Apr 6, 2026Monday, 6 April 2026, 16:16	5.4 MEDIUM	—
An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Role Name parameter.
CVE-2026-31350 ↗	Apr 6, 2026Monday, 6 April 2026, 16:16	5.4 MEDIUM	—
An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Page Sign parameter.
CVE-2026-31351 ↗	Apr 6, 2026Monday, 6 April 2026, 16:16	4.8 MEDIUM	—
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
CVE-2025-65657 ↗	Dec 2, 2025Tuesday, 2 December 2025, 21:15	6.5 MEDIUM	—
FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
CVE-2025-63520 ↗	Dec 1, 2025Monday, 1 December 2025, 15:15	6.1 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
CVE-2025-63523 ↗	Dec 1, 2025Monday, 1 December 2025, 15:15	6.5 MEDIUM	—
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
CVE-2025-63522 ↗	Dec 1, 2025Monday, 1 December 2025, 15:15	4.6 MEDIUM	—
Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function
CVE-2020-21489 ↗	Jun 20, 2023Tuesday, 20 June 2023, 15:15	9.8 CRITICAL	—
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
CVE-2020-21174 ↗	Jun 20, 2023Tuesday, 20 June 2023, 15:15	9.8 CRITICAL	—
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
CVE-2022-40373 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	5.4 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
CVE-2022-40000 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	5.4 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
CVE-2022-40001 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	5.4 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
CVE-2022-40002 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	5.4 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
CVE-2021-36573 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	5.4 MEDIUM	—
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.
CVE-2020-20589 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	6.1 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
CVE-2021-36572 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	6.1 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.
CVE-2020-36607 ↗	Dec 15, 2022Thursday, 15 December 2022, 19:15	6.1 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
CVE-2020-21516 ↗	Sep 6, 2022Tuesday, 6 September 2022, 19:15	9.8 CRITICAL	—
There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.
CVE-2022-34140 ↗	Jul 28, 2022Thursday, 28 July 2022, 00:15	5.4 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
CVE-2022-34971 ↗	Jul 27, 2022Wednesday, 27 July 2022, 02:15	8.8 HIGH	—
An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2020-21322 ↗	Sep 15, 2021Wednesday, 15 September 2021, 22:15	9.8 CRITICAL	7.5 HIGH
An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-30108 ↗	May 24, 2021Monday, 24 May 2021, 20:15	9.1 CRITICAL	6.4 MEDIUM
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
CVE-2020-22643 ↗	Jan 26, 2021Tuesday, 26 January 2021, 18:15	7.2 HIGH	6.5 MEDIUM
Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
CVE-2020-21146 ↗	Jan 26, 2021Tuesday, 26 January 2021, 18:15	6.1 MEDIUM	4.3 MEDIUM
Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.