CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

CVE-2026-90496

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90497

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

EUVD-2026-76950

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497

Fengoffice Feng Office versions up to 3.11.13.11 are affected by a cross-site scripting (XSS) vulnerability in the getTitle function of the file application/views/task/add_task.php (component: Task Title Output). Manipulating the og_objects.name argument allows a remote attacker to inject script ...

CVE-2026-90496

A SQL injection vulnerability exists in Fengoffice Feng Office versions up to 3.11.13.11 , affecting the update_system_module_order/update_dimension_order functions in the file application/controllers/MoreController.class.php (component: Reorder Handlers ). An authenticated attacker (high privile...

CVE-2026-90496 Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

EUVD-2026-76949

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90496 Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90495

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

EUVD-2026-76942

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2026-90495 Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

CVE-2026-90495

Fengoffice Feng Office versions up to 3.11.13.11 contain a SQL injection vulnerability in the Legacy API component, specifically in the function Contacts::instance->findAll within the file application/models/CompanyWebsite.class.php. Manipulation of the auth argument allows a remote, unauthent...

PT-2026-90785

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

PT-2026-90788

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description An issue exists in the Reorder Handlers component within the file application/controllers/MoreController.class.php. A remote attacker can perform a SQL injection by manipulating t...

PT-2026-90789

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle function located in the application/views/task/add task.php...

CVE-2026-90496: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...