CVE-2019-9825: Feifeicms

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature.

Affected products

• Feifeicms Feifeicms: version 4.1.190209 only

Published 2019-03-14. Last modified 2026-06-17.