# feehi/cms (Packagist) vulnerabilities 21 known vulnerabilities (2 critical, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/feehi/cms ## Advisories (21) ### [CVE-2026-31354](https://cve.now/CVE-2026-31354): Multiple authenticated stored cross-site scripting (XSS) vulnerabilities in the Permissions module of Feehi CMS v2.1.1 allows attackers to… - Severity: Medium 5.4 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2026-31353](https://cve.now/CVE-2026-31353): An authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute… - Severity: Medium 5.4 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2026-31352](https://cve.now/CVE-2026-31352): An authenticated stored cross-site scripting (XSS) vulnerability in the Role Management module of Feehi CMS v2.1.1 allows attackers to… - Severity: Medium 5.4 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2026-31351](https://cve.now/CVE-2026-31351): An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to… - Severity: Medium 4.8 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2026-31350](https://cve.now/CVE-2026-31350): An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or… - Severity: Medium 5.4 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2026-31313](https://cve.now/CVE-2026-31313): An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to… - Severity: Medium 5.4 - Published: Apr 6, 2026 - Affected: versions 2.1.1. ### [CVE-2025-65657](https://cve.now/CVE-2025-65657): FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. - Severity: Medium 6.5 - Published: Dec 2, 2025 - Affected: through 2.1.1. ### [CVE-2024-8296](https://cve.now/CVE-2024-8296): FeehiCMS index.php insert unrestricted upload - Severity: Medium 5.3 - Published: Aug 29, 2024 - Affected: through 2.1.1. ### [CVE-2024-8295](https://cve.now/CVE-2024-8295): FeehiCMS index.php createBanner unrestricted upload - Severity: Medium 5.3 - Published: Aug 29, 2024 - Affected: through 2.1.1. ### [CVE-2024-8294](https://cve.now/CVE-2024-8294): FeehiCMS index.php update unrestricted upload - Severity: Medium 5.3 - Published: Aug 29, 2024 - Affected: through 2.1.1. ### [CVE-2020-21489](https://cve.now/CVE-2020-21489): File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the… - Severity: Critical 9.8 - Published: Jun 20, 2023 - Affected: fixed in 2.0.8.1. ### [CVE-2020-21174](https://cve.now/CVE-2020-21174): File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function. - Severity: Critical 9.8 - Published: Jun 20, 2023 - Affected: fixed in 2.0.8.1. ### [CVE-2022-43320](https://cve.now/CVE-2022-43320): FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at… - Severity: Medium 6.1 - Published: Nov 9, 2022 - Affected: through 2.1.1. ### [CVE-2022-38796](https://cve.now/CVE-2022-38796): A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. - Severity: Unrated - Published: Sep 14, 2022 - Affected: through 2.1.1. ### [CVE-2020-21516](https://cve.now/CVE-2020-21516): There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP… - Severity: Unrated - Published: Sep 6, 2022 - Affected: fixed in 2.0.8.1. ### [CVE-2022-34140](https://cve.now/CVE-2022-34140): A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary… - Severity: Unrated - Published: Jul 27, 2022 - Affected: through 2.1.1. ### [CVE-2022-34971](https://cve.now/CVE-2022-34971): An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code… - Severity: Unrated - Published: Jul 27, 2022 - Affected: through 2.1.1. ### [CVE-2020-21322](https://cve.now/CVE-2020-21322): An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file. - Severity: Unrated - Published: Sep 15, 2021 - Affected: fixed in 2.0.8.1. ### [CVE-2021-30108](https://cve.now/CVE-2021-30108): Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. - Severity: Unrated - Published: May 24, 2021 - Affected: through 2.1.1. ### [CVE-2020-21146](https://cve.now/CVE-2020-21146): Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. - Severity: Unrated - Published: Jan 21, 2021 - Affected: fixed in 2.0.8.1. ### [CVE-2020-22643](https://cve.now/CVE-2020-22643): Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. - Severity: Unrated - Published: Jan 21, 2021 - Affected: through 2.1.0-beta. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/feehi/cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.