Cross Site Scripting Vulnerability in FeehiCMS by Liufee
CVE-2025-63520

6.1MEDIUM

Key Information:

Vendor

Liufee

Status
FeehiCMS
Vendor
CVE Published:
1 December 2025

What is CVE-2025-63520?

A Cross Site Scripting (XSS) vulnerability has been identified in FeehiCMS version 2.1.1, which can be exploited via the 'id' parameter in the User Update function. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and overall application security. It is essential for users to apply security best practices and update to patched versions to mitigate risks. For more details, refer to the provided references.

References

https://github.com/liufee/cms/issues/74
https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63520.md

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.