GitHub Advisoryadvisory · Packagist

GHSA-qgc9-p7cj-jvh6 FeehiCMS fails to enforce server-side immutability

MEDIUM Published 2025-12-01 Modified 2025-12-02 Official page ↗
Aliases
CVE-2025-63523
Ecosystem
Packagist
Packages
feehi/feehicms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-125
Reviewed
2025-12-02

Affected packages

• Packagist feehi/feehicms: 2.1.1 (no fix yet)

Description

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.

Related

Alias · CVE (1)

  • CVE-2025-63523 FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An… vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References