CVE-2025-63523: Feehi Feehicms

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.

Affected products

• Feehi Feehicms: version 2.1.1 only

Published 2025-12-01. Last modified 2026-06-17.