CVE-2025-63520
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to theft of session data or other sensitive information.
Recommendation
Implement proper input validation and encoding mechanisms, especially for the id parameter, and consider updating to a version that fixes this vulnerability.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-86239Medium
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-51953High
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
- CVE-2025-65657Medium
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
- CVE-2025-63523Medium
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- CVE-2025-63522Medium
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
Original NVD description (English source)
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS