Search results

FeehiCMS Pre-auth Broken Access Control — draft & password/login-protected Single-Pages disclosed via frontend page route (source-confirmed, ArticleService.php:163 + PageController.php)

Status: Open.

#93 In liufee/cms;

· h0rk1p opened on Jun 20, 2026

FeehiCMS Pre-auth Path Traversal / Local File Inclusion via site/view 'type' parameter (source-confirmed, common/components/Feehi.php:79)

Status: Open.

#92 In liufee/cms;

· h0rk1p opened on Jun 20, 2026

Feehi CMS 2.1.1 - API UserController IDOR allows full account takeover

Status: Open.

#90 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API UserController IDOR allows arbitrary user deletion

Status: Open.

#89 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API UserController allows PII enumeration without authorization

Status: Open.

#88 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API ArticleController has no authentication, CRUD operations exposed

Status: Open.

#87 In liufee/cms;

· byname66 opened on May 29, 2026

Session Reuse After Logout in Feehi CMS 2.1.1

Status: Open.

#86 In liufee/cms;

· altamish1994 opened on May 4, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Permission

Status: Open.

#85 In liufee/cms;

· thinhneee opened on Feb 10, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Category

Status: Open.

#84 In liufee/cms;

· thinhneee opened on Feb 9, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Role

Status: Open.

#83 In liufee/cms;

· thinhneee opened on Feb 7, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Page Sign

Status: Open.

#82 In liufee/cms;

· thinhneee opened on Feb 7, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Article Title.

Status: Open.

#81 In liufee/cms;

· thinhneee opened on Feb 6, 2026