Is feehi/feehicms safe ? feehi/feehicms (packagist) has 14 known vulnerabilities, the worst rated MODERATE. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 18th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-c2vx-rx6x-m9wj, the advisory selected below
// 14 advisories GHSA-c2vx-rx6x-m9wj Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate). MODE GHSA-w756-rf26-7rmr Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function MODE GHSA-qgc9-p7cj-jvh6 FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can… MODE GHSA-gqgq-784q-v9xp Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page. MODE GHSA-pwh3-3pcm-6vjh Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. MODE GHSA-6vh6-72g6-xqx2 Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify. MODE GHSA-m54v-gv8p-9pqp Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page. MODE GHSA-xv8h-43h9-v3jq Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file. MODE GHSA-67mh-hw8v-x8v9 File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload. MODE GHSA-8vjp-hfgh-68rj Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page. MODE Show all 14 advisories Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None // questions Is feehi/feehicms safe to install? CyberXYZ does not call a package safe in absolute terms. It records 14 known vulnerabilities for feehi/feehicms (packagist), the worst rated MODERATE, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does feehi/feehicms have known vulnerabilities? Yes. CyberXYZ records 14 known vulnerabilities for feehi/feehicms (packagist), the worst rated MODERATE. These include GHSA-c2vx-rx6x-m9wj, GHSA-w756-rf26-7rmr, GHSA-qgc9-p7cj-jvh6, GHSA-gqgq-784q-v9xp, GHSA-pwh3-3pcm-6vjh.
How do I check feehi/feehicms before installing? Search feehi/feehicms in CyberXYZ Check at https://cyberxyz.io/check?q=feehi%2Ffeehicms . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:49 UTC. The most recent advisory here was published 2025-12-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page