Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Feng Office by Fengoffice
CVE-2026-90497 (GCVE-0-2026-90497)
Vulnerability from nvd – Published: 2026-09-13 05:45 – Updated: 2026-09-14 15:45
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
Summary
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 15:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403085 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403085/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90497 | third-party-advisory |
| https://vuldb.com/submit/892874 | third-party-advisory |
| https://drive.google.com/file/d/1Kel7JTTXVcLDPCVp… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90497",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T15:44:56.180547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:45:08.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Task Title Output"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T05:45:10.807Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403085 | Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403085"
},
{
"name": "VDB-403085 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403085/cti"
},
{
"name": "CVE-2026-90497 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90497"
},
{
"name": "Submit #892874 | Feng Office Feng Office Community Edition 3.11.13.11 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892874"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90497",
"datePublished": "2026-09-13T05:45:10.807Z",
"dateReserved": "2026-09-12T08:16:13.257Z",
"dateUpdated": "2026-09-14T15:45:08.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90496 (GCVE-0-2026-90496)
Vulnerability from nvd – Published: 2026-09-13 05:30 – Updated: 2026-09-16 13:56
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
Summary
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:56 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403084 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403084/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90496 | third-party-advisory |
| https://vuldb.com/submit/892873 | third-party-advisory |
| https://drive.google.com/file/d/1Kel7JTTXVcLDPCVp… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90496",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:56:00.514565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:56:18.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Reorder Handlers"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T05:30:11.239Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403084 | Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403084"
},
{
"name": "VDB-403084 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403084/cti"
},
{
"name": "CVE-2026-90496 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90496"
},
{
"name": "Submit #892873 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892873"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90496",
"datePublished": "2026-09-13T05:30:11.239Z",
"dateReserved": "2026-09-12T08:16:10.094Z",
"dateUpdated": "2026-09-16T13:56:18.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90495 (GCVE-0-2026-90495)
Vulnerability from nvd – Published: 2026-09-13 03:30 – Updated: 2026-09-14 18:07
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
Summary
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:05 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403083 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403083/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90495 | third-party-advisory |
| https://vuldb.com/submit/892871 | third-party-advisory |
| https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90495",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:05:34.886975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:07:48.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Legacy API"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-\u003efindAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T03:30:05.543Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403083 | Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance-\u003efindAll sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403083"
},
{
"name": "VDB-403083 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403083/cti"
},
{
"name": "CVE-2026-90495 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90495"
},
{
"name": "Submit #892871 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892871"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance-\u003efindAll sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90495",
"datePublished": "2026-09-13T03:30:05.543Z",
"dateReserved": "2026-09-12T08:16:06.602Z",
"dateUpdated": "2026-09-14T18:07:48.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5877 (GCVE-0-2025-5877)
Vulnerability from nvd – Published: 2025-06-09 12:31 – Updated: 2025-06-09 13:00
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
Summary
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-09 13:00 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.311636 | vdb-entry |
| https://vuldb.com/?ctiid.311636 | signaturepermissions-required |
| https://vuldb.com/?submit.586971 | third-party-advisory |
| https://gist.github.com/mcdruid/e78694d754f448848… | related |
| https://gist.github.com/mcdruid/e78694d754f448848… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.2.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5877",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T13:00:41.749852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T13:00:44.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa#steps-to-reproduce"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Document Upload Handler"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.2.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mcdruid (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in Fengoffice Feng Office 3.2.2.1 entdeckt. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /application/models/ApplicationDataObject.class.php der Komponente Document Upload Handler. Mittels Manipulieren mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-610",
"description": "Externally Controlled Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T12:31:04.643Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-311636 | Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.311636"
},
{
"name": "VDB-311636 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.311636"
},
{
"name": "Submit #586971 | Feng Office \u003e= v3.2.2.1 XXE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.586971"
},
{
"tags": [
"related"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa#steps-to-reproduce"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-08T20:10:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5877",
"datePublished": "2025-06-09T12:31:04.643Z",
"dateReserved": "2025-06-08T18:05:09.822Z",
"dateUpdated": "2025-06-09T13:00:44.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5433 (GCVE-0-2025-5433)
Vulnerability from nvd – Published: 2025-06-02 06:31 – Updated: 2025-06-02 13:35
VLAI
EPSS
VEX
Title
Fengoffice Feng Office index.php sql injection
Summary
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-02 13:35 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.310766 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.310766 | signaturepermissions-required |
| https://vuldb.com/?submit.584259 | third-party-advisory |
| https://github.com/YZS17/CVE/blob/main/SQL/SQLi%2… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.5.1.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5433",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T13:35:31.884138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T13:35:50.746Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.5.1.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "XU17 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account\u0026a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Fengoffice Feng Office 3.5.1.5 gefunden. Sie wurde als kritisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /index.php?c=account\u0026a=set_timezone. Mittels dem Manipulieren des Arguments tz_offset mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T06:31:04.742Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-310766 | Fengoffice Feng Office index.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.310766"
},
{
"name": "VDB-310766 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.310766"
},
{
"name": "Submit #584259 | https://www.fengoffice.com/ fengoffice 3.5.1.5 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.584259"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20fengoffice_3.5.1.5.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-01T13:00:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office index.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5433",
"datePublished": "2025-06-02T06:31:04.742Z",
"dateReserved": "2025-06-01T10:55:38.487Z",
"dateUpdated": "2025-06-02T13:35:50.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-90497 (GCVE-0-2026-90497)
Vulnerability from cvelistv5 – Published: 2026-09-13 05:45 – Updated: 2026-09-14 15:45
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting
Summary
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 15:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403085 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403085/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90497 | third-party-advisory |
| https://vuldb.com/submit/892874 | third-party-advisory |
| https://drive.google.com/file/d/1Kel7JTTXVcLDPCVp… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90497",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T15:44:56.180547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:45:08.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Task Title Output"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T05:45:10.807Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403085 | Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403085"
},
{
"name": "VDB-403085 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403085/cti"
},
{
"name": "CVE-2026-90497 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90497"
},
{
"name": "Submit #892874 | Feng Office Feng Office Community Edition 3.11.13.11 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892874"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90497",
"datePublished": "2026-09-13T05:45:10.807Z",
"dateReserved": "2026-09-12T08:16:13.257Z",
"dateUpdated": "2026-09-14T15:45:08.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90496 (GCVE-0-2026-90496)
Vulnerability from cvelistv5 – Published: 2026-09-13 05:30 – Updated: 2026-09-16 13:56
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection
Summary
A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:56 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403084 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403084/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90496 | third-party-advisory |
| https://vuldb.com/submit/892873 | third-party-advisory |
| https://drive.google.com/file/d/1Kel7JTTXVcLDPCVp… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90496",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:56:00.514565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:56:18.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Reorder Handlers"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T05:30:11.239Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403084 | Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403084"
},
{
"name": "VDB-403084 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403084/cti"
},
{
"name": "CVE-2026-90496 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90496"
},
{
"name": "Submit #892873 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892873"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90496",
"datePublished": "2026-09-13T05:30:11.239Z",
"dateReserved": "2026-09-12T08:16:10.094Z",
"dateUpdated": "2026-09-16T13:56:18.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90495 (GCVE-0-2026-90495)
Vulnerability from cvelistv5 – Published: 2026-09-13 03:30 – Updated: 2026-09-14 18:07
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
Summary
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:05 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403083 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403083/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90495 | third-party-advisory |
| https://vuldb.com/submit/892871 | third-party-advisory |
| https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90495",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:05:34.886975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:07:48.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"Legacy API"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-\u003efindAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T03:30:05.543Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403083 | Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance-\u003efindAll sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403083"
},
{
"name": "VDB-403083 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403083/cti"
},
{
"name": "CVE-2026-90495 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90495"
},
{
"name": "Submit #892871 | Feng Office Feng Office Community Edition 3.11.13.11 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892871"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:21:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance-\u003efindAll sql injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90495",
"datePublished": "2026-09-13T03:30:05.543Z",
"dateReserved": "2026-09-12T08:16:06.602Z",
"dateUpdated": "2026-09-14T18:07:48.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5877 (GCVE-0-2025-5877)
Vulnerability from cvelistv5 – Published: 2025-06-09 12:31 – Updated: 2025-06-09 13:00
VLAI
EPSS
VEX
Title
Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
Summary
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-09 13:00 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.311636 | vdb-entry |
| https://vuldb.com/?ctiid.311636 | signaturepermissions-required |
| https://vuldb.com/?submit.586971 | third-party-advisory |
| https://gist.github.com/mcdruid/e78694d754f448848… | related |
| https://gist.github.com/mcdruid/e78694d754f448848… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.2.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5877",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-09T13:00:41.749852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T13:00:44.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa#steps-to-reproduce"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Document Upload Handler"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.2.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mcdruid (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in Fengoffice Feng Office 3.2.2.1 entdeckt. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /application/models/ApplicationDataObject.class.php der Komponente Document Upload Handler. Mittels Manipulieren mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-610",
"description": "Externally Controlled Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T12:31:04.643Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-311636 | Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.311636"
},
{
"name": "VDB-311636 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.311636"
},
{
"name": "Submit #586971 | Feng Office \u003e= v3.2.2.1 XXE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.586971"
},
{
"tags": [
"related"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa#steps-to-reproduce"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-08T20:10:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5877",
"datePublished": "2025-06-09T12:31:04.643Z",
"dateReserved": "2025-06-08T18:05:09.822Z",
"dateUpdated": "2025-06-09T13:00:44.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5433 (GCVE-0-2025-5433)
Vulnerability from cvelistv5 – Published: 2025-06-02 06:31 – Updated: 2025-06-02 13:35
VLAI
EPSS
VEX
Title
Fengoffice Feng Office index.php sql injection
Summary
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-02 13:35 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.310766 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.310766 | signaturepermissions-required |
| https://vuldb.com/?submit.584259 | third-party-advisory |
| https://github.com/YZS17/CVE/blob/main/SQL/SQLi%2… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.5.1.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5433",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T13:35:31.884138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T13:35:50.746Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.5.1.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "XU17 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account\u0026a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Fengoffice Feng Office 3.5.1.5 gefunden. Sie wurde als kritisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei /index.php?c=account\u0026a=set_timezone. Mittels dem Manipulieren des Arguments tz_offset mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T06:31:04.742Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-310766 | Fengoffice Feng Office index.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.310766"
},
{
"name": "VDB-310766 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.310766"
},
{
"name": "Submit #584259 | https://www.fengoffice.com/ fengoffice 3.5.1.5 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.584259"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20fengoffice_3.5.1.5.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-01T13:00:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office index.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5433",
"datePublished": "2025-06-02T06:31:04.742Z",
"dateReserved": "2025-06-01T10:55:38.487Z",
"dateUpdated": "2025-06-02T13:35:50.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}