Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Feehi CMS: Attackers can inject malicious code through admin panel

CVE-2026-31351 · published 7 months ago
Summary

Attackers can inject malicious code into the Feehi CMS admin panel by manipulating the title of a new or edited item, potentially allowing them to take control of the site. This requires the attacker to already have authenticated access to the admin panel. To protect your site, update to a patched version of Feehi CMS or consider replacing it with a different content management system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer feehi cms 2.1.1
– feehi feehi_cms 2.1.1
cpe:2.3:a:feehi:feehi_cms:2.1.1:*:*:*:*:*:*:*
Original advisory text
Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module
An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published6 Apr 2026
Updated3 Nov 2026
First seen6 Apr 2026
Sources
CVE-2026-31351 · NVD
GHSA-cvjh-88c8-2jjx · GHSA
Track software like this
Free during beta