CVE-2025-5877

The CVE-2025-5877 is a confirmed issue in Fengoffice Feng Office 3.2.2.1. It affects unknown functionality in /application/models/ApplicationDataObject.class.php within the Document Upload Handler, enabling an XML external entity reference. The vulnerability can be exploited remotely, and the exp...

CVE-2024-6039

CVE-2024-6039 affects Feng Office 3.11.1.2 in the Workspaces component. The vulnerability stems from improper handling of the dim argument, leading to a SQL injection that can be triggered remotely. Public exploit info is noted in multiple sources. Impact is described as critical in the CVE recor...

CVE-2013-5744

CVE-2013-5744 affects Feng Office (2.3.2-rc and earlier). The issue is a Cross-Site Scripting (XSS) in the ref_[any] parameter passed to /index.php (e.g., ref_abc), caused by insufficient sanitisation of user-supplied data. Exploitation can lead to arbitrary HTML/JavaScript execution in the victi...

CVE-2019-9623

CVE-2019-9623 affects Feng Office 3.7.0.5. Remote code execution is possible via the injection vector "

CVE-2011-3738

Feng Office 1.7.2 is affected by an information-disclosure vulnerability: a direct request to certain PHP files (e.g., public/upgrade/templates/layout.php) can reveal the installation path in an error message. Affected component: Feng Office PHP files; root cause: error message leakage. Impact: p...

CVE-2014-5343

CVE-2014-5343 is an XSS vulnerability reported in Feng Office, allowing remote attackers to inject arbitrary script/HTML via the client Name field. The NVD entry lists impacts as: confidentiality none, integrity partial, availability none, with a base score 4.3 (Medium). Connected documents corro...