These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A weakness in liufee FeehiCMS up to 2.1.1 allows remote attackers to manipulate the cookieValidationKey argument, leading to the use of a hard-coded cryptographic key. The project was informed but has not responded yet. This issue impacts FeehiCMS installations, and defenders should assess exposure and prioritize verification and remediation efforts. The vulnerability is related to cookie validation, and [truncated]
A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source[] results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the prob [truncated]
CVE-2026-86239 is a medium-severity vulnerability in liufee FeehiCMS up to 2.1.1, specifically in the UeditorAction::init function of the UEditor Widget, allowing unrestricted file upload. The vulnerability has a CVSS score of 5.5. The project was informed but has not responded yet. Defenders should assess exposure and prioritize verification and remediation planning. The exploit is publicly available, in [truncated]