CVE-2025-63522
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
Risk Assessment
An attacker can replace the originating tab's content after a link is clicked, redirecting the user to a malicious site and potentially stealing credentials.
Recommendation
Add rel="noopener noreferrer" attributes to links opened in new tabs in the Comments Management function. Update FeehiCMS to a patched version.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-86239Medium
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-51953High
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
- CVE-2025-65657Medium
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
- CVE-2025-63523Medium
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- CVE-2025-63520Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Original NVD description (English source)
Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function
Vulnerability data from NVD (NIST) · CISA KEV · EPSS