CVE-2019-9623: Fengoffice Feng Office

Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days.

Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.

Affected products

• Fengoffice Feng Office: version 3.7.0.5 only

Published 2019-03-07. Last modified 2026-06-17.