CVE-2025-63523
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
Risk Assessment
An authenticated attacker can change usernames, potentially leading to data integrity issues or privilege escalation within the system.
Recommendation
Ensure that read-only parameters are immutable on the server side, for example by re-validating or rejecting changes, and consider updating to a version that fixes this vulnerability.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-86239Medium
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-51953High
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
- CVE-2025-65657Medium
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
- CVE-2025-63522Medium
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
- CVE-2025-63520Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Original NVD description (English source)
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS