PT-2025-48454 · Feehicms · Feehicms

Published 2025-12-01 · Updated 2025-12-01 · CVE-2025-63523

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FeehiCMS version 2.1.1

Description FeehiCMS version 2.1.1 does not properly enforce server-side immutability for parameters displayed as "read-only" to clients. An authenticated attacker can intercept and modify these parameters during transmission, and the backend system will accept the changes. This can result in unintended modifications, such as changes to a user's username. The vulnerable parameters are subject to manipulation in transit.

Recommendations Update FeehiCMS to a version where this issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-63523

GHSA-QGC9-P7CJ-JVH6

Affected Products

Feehicms

References · 6

• 🔥 https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63523.md · Exploit
• https://github.com/liufee/cms/issues/77 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-63523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63523 · Security Note
• https://twitter.com/VulmonFeeds/status/1995540515954081948 · Twitter Post
• https://twitter.com/CVEnew/status/1995519590088978901 · Twitter Post