Search results

Feehi CMS 2.1.1 - API UserController IDOR allows full account takeover

Status: Open.

#90 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API UserController IDOR allows arbitrary user deletion

Status: Open.

#89 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API UserController allows PII enumeration without authorization

Status: Open.

#88 In liufee/cms;

· byname66 opened on May 29, 2026

Feehi CMS 2.1.1 - API ArticleController has no authentication, CRUD operations exposed

Status: Open.

#87 In liufee/cms;

· byname66 opened on May 29, 2026

Session Reuse After Logout in Feehi CMS 2.1.1

Status: Open.

#86 In liufee/cms;

· altamish1994 opened on May 4, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Permission

Status: Open.

#85 In liufee/cms;

· thinhneee opened on Feb 10, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Category

Status: Open.

#84 In liufee/cms;

· thinhneee opened on Feb 9, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Role

Status: Open.

#83 In liufee/cms;

· thinhneee opened on Feb 7, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Page Sign

Status: Open.

#82 In liufee/cms;

· thinhneee opened on Feb 7, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Article Title.

Status: Open.

#81 In liufee/cms;

· thinhneee opened on Feb 6, 2026

Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Article Content.

Status: Open.

#80 In liufee/cms;

· thinhneee opened on Feb 6, 2026

Email Enumeration Vulnerability via Password Reset Functionality

Status: Open.

#79 In liufee/cms;

· d3adb3ef opened on Dec 17, 2025