FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
References
| Link | Resource |
|---|---|
| https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md | Exploit Third Party Advisory |
| https://github.com/liufee/cms/issues/78 | Exploit Third Party Advisory |
Configurations
History
19 Dec 2025, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md - Exploit, Third Party Advisory | |
| References | () https://github.com/liufee/cms/issues/78 - Exploit, Third Party Advisory | |
| First Time |
Feehi
Feehi feehicms |
|
| CPE | cpe:2.3:a:feehi:feehicms:2.1.1:*:*:*:*:*:*:* |
02 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
02 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-02 21:15
Updated : 2025-12-19 18:18
NVD link : CVE-2025-65657
Mitre link : CVE-2025-65657
CVE.ORG link : CVE-2025-65657
JSON object : View
Products Affected
feehi
- feehicms
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')