3
CVEs
0
Critical
0
High
0
KEV
3
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
1
LOW
2
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90495 | Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-90496 | Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|
| CVE-2026-90497 | Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|