What is the CVSS score of CVE-2025-63520?

CVE-2025-63520 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Feehicms are affected by CVE-2025-63520?

CVE-2025-63520 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

Is there a public PoC exploit available for CVE-2025-63520?

Yes, a public proof-of-concept exploit is available for CVE-2025-63520. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-63520?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Feehicms CVE-2025-63520

EUVD-2025-200003 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-01 cve@mitre.org

GHSA-c2vx-rx6x-m9wj

XSS Feehicms Feehi

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200003

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Dec 02, 2025 - 03:06 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 15:15 nvd

MEDIUM 6.1

DescriptionCVE.org

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).

Analysis

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

More in Feehicms

View all

CVE-2025-65657 MEDIUM This Month POC

6.5 Dec 02

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1

CVE-2025-63523 MEDIUM This Month POC

6.5 Dec 01

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-o

CVE-2022-43320 MEDIUM This Month POC

6.1 Nov 09

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /

CVE-2026-86239 MEDIUM This Month POC

5.5 Sep 07

Unrestricted file upload in FeehiCMS up to version 2.1.1 allows unauthenticated remote attackers to upload arbitrary fil

CVE-2022-40373 MEDIUM This Month POC

5.4 Dec 15

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of c

CVE-2022-40002 MEDIUM This Month POC

5.4 Dec 15

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callbac

CVE-2022-40001 MEDIUM This Month POC

5.4 Dec 15

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title f

CVE-2022-40000 MEDIUM This Month POC

5.4 Dec 15

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the usernam

CVE-2022-40408 MEDIUM This Month POC

5.4 Sep 29

FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into

CVE-2024-8296 MEDIUM This Month POC

5.3 Aug 29

A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical.php?r=user%2Fcreate. Rated medium severity

CVE-2024-8295 MEDIUM This Month POC

5.3 Aug 29

A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. Rated medium severity (CVSS 5.3), thi

CVE-2024-8294 MEDIUM This Month POC

5.3 Aug 29

A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. Rated medium severity (CVSS 5.3),

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-1710 CRITICAL POC

10.0

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2024-52875 HIGH POC

8.8

CVE-2025-63520 vulnerability details – vuln.today

Back

Feehicms CVE-2025-63520

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Feehicms

Same weakness CWE-79 – Cross-site Scripting (XSS)

Same technique XSS

Share

External POC / Exploit Code