Stored Cross-Site Scripting in Feehi CMS by Liufee
CVE-2026-31351

4.8MEDIUM

Key Information:

Vendor

Liufee

Status
Feehi CMS
Vendor
CVE Published:
6 April 2026

What is CVE-2026-31351?

An authenticated stored cross-site scripting vulnerability exists in the creation and editing module of Feehi CMS version 2.1.1. This flaw allows attackers to inject malicious scripts or HTML content through the Title parameter, leading to the execution of arbitrary web scripts on the victim’s browser. Exploitation of this vulnerability can compromise user sessions and potentially expose sensitive information.

References

https://github.com/liufee/cms
https://github.com/liufee/cms/issues/81

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.