CVE-2025-63523
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify …
Published: 2025-12-01 · CVSS: 6.5 · CVSS 3.1
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7