# feehi/feehicms (Packagist) vulnerabilities

14 known vulnerabilities (13 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/feehi/feehicms

## Advisories (14)

### [CVE-2025-63523](https://cve.now/CVE-2025-63523): FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An…

- Severity: Medium 6.5
- Published: Dec 1, 2025
- Affected: versions 2.1.1.

### [CVE-2025-63522](https://cve.now/CVE-2025-63522): Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function

- Severity: Medium 4.6
- Published: Dec 1, 2025
- Affected: through 2.1.1.

### [CVE-2025-63520](https://cve.now/CVE-2025-63520): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).

- Severity: Medium 6.1
- Published: Dec 1, 2025
- Affected: versions 2.1.1.

### [CVE-2022-40373](https://cve.now/CVE-2022-40373): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.

- Severity: Medium 5.4
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2022-40002](https://cve.now/CVE-2022-40002): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to…

- Severity: Medium 5.4
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2022-40001](https://cve.now/CVE-2022-40001): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create…

- Severity: Medium 5.4
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2022-40000](https://cve.now/CVE-2022-40000): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the…

- Severity: Medium 5.4
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2021-36573](https://cve.now/CVE-2021-36573): File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.

- Severity: Medium 5.4
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2021-36572](https://cve.now/CVE-2021-36572): Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the…

- Severity: Medium 6.1
- Published: Dec 15, 2022
- Affected: through 2.1.1.

### [CVE-2020-36607](https://cve.now/CVE-2020-36607): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html…

- Severity: Medium 6.1
- Published: Dec 15, 2022
- Affected: through 2.0.8.

### [CVE-2020-20589](https://cve.now/CVE-2020-20589): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html…

- Severity: Medium 6.1
- Published: Dec 15, 2022
- Affected: through 2.0.8.

### [CVE-2022-4014](https://cve.now/CVE-2022-4014): FeehiCMS Post My Comment Tab cross-site request forgery

- Severity: Medium 4.3
- Published: Nov 16, 2022
- Affected: through 2.0.1.1.

### [CVE-2022-40408](https://cve.now/CVE-2022-40408): FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box…

- Severity: Medium 5.4
- Published: Sep 29, 2022
- Affected: through 2.0.1.1.

### [CVE-2020-19709](https://cve.now/CVE-2020-19709): Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.

- Severity: Unrated
- Published: Aug 26, 2021
- Affected: through 0.1.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/feehi/feehicms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.