CVE-2025-65657

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management

Medium · published December 2, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00396 · 32.6th percentile
Published
2025-12-02T00:00Z
EPSS history
Timeline
  • 02 DEC 00:00Z
    FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management
    cvelistv5