FO
Product
Feng Office
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 2Low 1
Watch
Add Feng Office to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9623 | 9.8 | Mar 7 | Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php Affected: 3.7.0.5 |
| CVE-2024-6039 | 8.8 | Jun 16 | Feng Office Workspaces sql injection Affected: 3.11.1.2 |
| CVE-2025-5877 | 8.1 | Jun 9 | Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference Affected: 3.2.2.1 |
| CVE-2026-90495 | 7.3 | Sep 13 | Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection Affected: 3.11.13.0; 3.11.13.1; 3.11.13.2; 3.11.13.3; 3.11.13.4; 3.11.13.5; +6 more |
| CVE-2025-5433 | 6.3 | Jun 2 | Fengoffice Feng Office index.php sql injection Affected: 3.5.1.5 |
| CVE-2026-90496 | 4.7 | Sep 13 | Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection Affected: 3.11.13.0; 3.11.13.1; 3.11.13.2; 3.11.13.3; 3.11.13.4; 3.11.13.5; +6 more |
| CVE-2026-90497 | 3.5 | Sep 13 | Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting Affected: 3.11.13.0; 3.11.13.1; 3.11.13.2; 3.11.13.3; 3.11.13.4; 3.11.13.5; +6 more |
| CVE-2014-5343 | – | Aug 19 | Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field Affected: 1.6.2; 1.7; 1.7; 1.7; 1.7; 1.7; +34 more |
| CVE-2013-5744 | – | Oct 28 | Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter Affected: through 2.3.2; 1.6.2; 1.7; 1.7; 1.7; 1.7; +34 more |
| CVE-2011-3738 | – | Sep 23 | Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 1.7.2 |
Showing 10