CVE-2025-65657

6.5 mediumEPSS 0.4%

Medium (6.5) in feehi feehicms. EPSS 0.4% chance of exploitation in the next 30 days.

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2025-12-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

feehi:feehicms

References

https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md
https://github.com/liufee/cms/issues/78

Check your stack JSON