PT-2025-54214 · Feehicms+1 · Feehicms+1

Hiro · Published 2025-12-30 · Updated 2025-12-30 · CVE-2025-15264

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FeehiCMS versions up to 2.1.1

Description A server-side request forgery condition exists in FeehiCMS due to manipulation of the src argument within an unknown function of the frontend/web/timthumb.php file of the TimThumb component. This allows for remote exploitation. The exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Versions prior to 2.1.1 should be updated.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-15264

Affected Products

Feehicms

Timthumb

References · 9

• https://osv.dev/vulnerability/CVE-2025-15264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15264 · Security Note
• https://t.me/CVEtracker/40988 · Telegram Post
• https://twitter.com/CVEnew/status/2006132905093788017 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006151420005736806 · Twitter Post
• https://vuldb.com/?submit.718278 · Note
• https://vuldb.com/?ctiid.338663 · Note
• https://twitter.com/RedPacketSec/status/2006096653908951112 · Twitter Post
• https://vuldb.com/?id.338663 · Note