CVE-2026-51953
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FeehiCMS version 2.1.1 contains a vulnerability in the session management module, authentication logic, and logout handler components, allowing an attacker to escalate privileges.
Risk Assessment
An attacker can gain higher privileges in the system, potentially leading to full compromise of the application.
Recommendation
Update FeehiCMS to the latest version containing the fix.
Other vulnerabilities in FeehiCMS
See all- CVE-2026-86239Medium
A vulnerability was identified in FeehiCMS up to version 2.1.1 in the UEditor Widget component, in the UeditorAction::init function of the file backend/widgets/ueditor/UeditorAction.php. The manipulation leads to unrestricted file upload. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2025-65657Medium
FeehiCMS version 2.1.1 contains a remote code execution vulnerability via unrestricted file upload in the Ad Management module. An authenticated remote attacker can upload a crafted PHP file that the server later executes.
- CVE-2025-63523Medium
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
- CVE-2025-63522Medium
A Reverse Tabnabbing vulnerability exists in FeehiCMS 2.1.1 in the Comments Management function. Links opened in a new tab may allow control over the originating tab.
- CVE-2025-63520Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Original NVD description (English source)
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
Vulnerability data from NVD (NIST) · CISA KEV · EPSS