Feng Office
Monthly
Authenticated server-side request forgery in Feng Office up to 3.11.13.11 and 4.2.1.2 lets a low-privileged user coerce the server into fetching attacker-supplied URLs via the upload_document_image function in FilesController.class.php. The issue is rated CVSS 5.3 (moderate) and is gated by authentication; the real-world impact depends on which internal services or metadata endpoints are reachable from the server. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is listed in the provided intelligence, and no vendor-confirmed fixed version is available because the vendor did not respond.
Code injection in the Translation Tool component of Feng Office (versions up to and including 3.11.13.11 and up to and including 4.2.1.2) allows an attacker holding a high-privilege, administrative session to manipulate the 'lang' argument passed to the write_translations function in application/controllers/ToolController.class.php and inject code that the PHP application will execute. The administrative authentication gate (PR:H in the assessed CVSS 3.1 vector, AV:N/AC:L/UI:N) is the primary limiting factor and puts the flaw out of reach of anonymous remote attackers, though impact on confidentiality, integrity and availability is high once that access is held. No CISA KEV entry or confirmed active exploitation is associated with this CVE; a public PoC reference exists on a GitHub gist, but it is not verified as working exploit code, and the issue is rated for remediation within this month rather than as an emergency.
Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.
Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
CVE-2025-5877 is a security vulnerability (CVSS 6.3). Risk factors: public PoC available.
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Authenticated server-side request forgery in Feng Office up to 3.11.13.11 and 4.2.1.2 lets a low-privileged user coerce the server into fetching attacker-supplied URLs via the upload_document_image function in FilesController.class.php. The issue is rated CVSS 5.3 (moderate) and is gated by authentication; the real-world impact depends on which internal services or metadata endpoints are reachable from the server. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is listed in the provided intelligence, and no vendor-confirmed fixed version is available because the vendor did not respond.
Code injection in the Translation Tool component of Feng Office (versions up to and including 3.11.13.11 and up to and including 4.2.1.2) allows an attacker holding a high-privilege, administrative session to manipulate the 'lang' argument passed to the write_translations function in application/controllers/ToolController.class.php and inject code that the PHP application will execute. The administrative authentication gate (PR:H in the assessed CVSS 3.1 vector, AV:N/AC:L/UI:N) is the primary limiting factor and puts the flaw out of reach of anonymous remote attackers, though impact on confidentiality, integrity and availability is high once that access is held. No CISA KEV entry or confirmed active exploitation is associated with this CVE; a public PoC reference exists on a GitHub gist, but it is not verified as working exploit code, and the issue is rated for remediation within this month rather than as an emergency.
Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.
Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
CVE-2025-5877 is a security vulnerability (CVSS 6.3). Risk factors: public PoC available.
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.