Issues

• FeehiCMS Empty cookieValidationKey in Production Environment

  liufee/cms#96 · Filter by author yang5ynag opened on Jul 22, 2026

• FeehiCMS UEditor catchImage Server-Side Request Forgery (SSRF)

  liufee/cms#95 · Filter by author yang5ynag opened on Jul 22, 2026

• FeehiCMS UEditor Unauthorized Arbitrary File Upload

  liufee/cms#94 · Filter by author yang5ynag opened on Jul 22, 2026

• FeehiCMS Pre-auth Broken Access Control — draft & password/login-protected Single-Pages disclosed via frontend page route (source-confirmed, ArticleService.php:163 + PageController.php)

  liufee/cms#93 · Filter by author h0rk1p opened on Jun 20, 2026

• FeehiCMS Pre-auth Path Traversal / Local File Inclusion via site/view 'type' parameter (source-confirmed, common/components/Feehi.php:79)

  liufee/cms#92 · Filter by author h0rk1p opened on Jun 20, 2026

• Feehi CMS 2.1.1 - API UserController IDOR allows full account takeover

  liufee/cms#90 · Filter by author byname66 opened on May 29, 2026

• Feehi CMS 2.1.1 - API UserController IDOR allows arbitrary user deletion

  liufee/cms#89 · Filter by author byname66 opened on May 29, 2026

• Feehi CMS 2.1.1 - API UserController allows PII enumeration without authorization

  liufee/cms#88 · Filter by author byname66 opened on May 29, 2026

• Feehi CMS 2.1.1 - API ArticleController has no authentication, CRUD operations exposed

  liufee/cms#87 · Filter by author byname66 opened on May 29, 2026

• Session Reuse After Logout in Feehi CMS 2.1.1

  liufee/cms#86 · Filter by author altamish1994 opened on May 4, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Permission

  liufee/cms#85 · Filter by author thinhneee opened on Feb 10, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Category

  liufee/cms#84 · Filter by author thinhneee opened on Feb 9, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Role

  liufee/cms#83 · Filter by author thinhneee opened on Feb 7, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Page Sign

  liufee/cms#82 · Filter by author thinhneee opened on Feb 7, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Article Title.

  liufee/cms#81 · Filter by author thinhneee opened on Feb 6, 2026

• Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Article Content.

  liufee/cms#80 · Filter by author thinhneee opened on Feb 6, 2026

• Email Enumeration Vulnerability via Password Reset Functionality

  liufee/cms#79 · Filter by author d3adb3ef opened on Dec 17, 2025

• FeehiCMS version 2.1.1 - Remote Code Execution via Unrestricted File Upload in Ad Management

  liufee/cms#78 · Filter by author kiwi865 opened on Oct 2, 2025

• FeehiCMS version 2.1.1 - Parameter Tampering for Read-Only Username Parameter

  liufee/cms#77 · Filter by author kiwi865 opened on Oct 2, 2025

• FeehiCMS version 2.1.1 - Reverse Tabnabbing due to Improper Security Attributes Configured for External Links

  liufee/cms#76 · Filter by author kiwi865 opened on Oct 2, 2025

• FeehiCMS version 2.1.1 - Improper output encoding in username parameter of Admin Log function lead to Cross Site Scripting (XSS).

  liufee/cms#75 · Filter by author kiwi865 opened on Oct 2, 2025

• FeehiCMS version 2.1.1 - Cross Site Scripting (XSS) in id parameter of User Update function

  liufee/cms#74 · Filter by author kiwi865 opened on Oct 2, 2025

• FeehiCMS version 2.1.1 - Cross Site Scripting (XSS) in id parameter of Banner Update function

  liufee/cms#73 · Filter by author kiwi865 opened on Oct 2, 2025

• Cross Site Scripting Vulnerability through the use of Statics Script in FeehiCMS-2.1.1

  liufee/cms#72 · Filter by author githubmof opened on Apr 2, 2024

• File upload command execution at Picture upload

  liufee/cms#70 · Filter by author TianT1209 opened on Oct 7, 2022