Fengoffice

Feng Office

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2025-5877

Exploit
  • EPSS 0.04%
  • Veröffentlicht 09.06.2025 12:31:04
  • Zuletzt bearbeitet 02.07.2025 19:17:43

A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upl...

6.3

CVE-2025-5433

  • EPSS 0.04%
  • Veröffentlicht 02.06.2025 06:31:04
  • Zuletzt bearbeitet 02.06.2025 17:32:17

A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql inje...

8.8

CVE-2024-6039

Exploit
  • EPSS 0.16%
  • Veröffentlicht 16.06.2024 22:15:09
  • Zuletzt bearbeitet 21.11.2024 09:48:48

A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remote...

9.8

CVE-2019-9623

Exploit
  • EPSS 17.26%
  • Veröffentlicht 07.03.2019 05:29:01
  • Zuletzt bearbeitet 21.11.2024 04:51:59

Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.

4.3

CVE-2014-5343

  • EPSS 0.25%
  • Veröffentlicht 19.08.2014 18:55:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field.

4.3

CVE-2013-5744

Exploit
  • EPSS 0.32%
  • Veröffentlicht 28.10.2013 22:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.

5

CVE-2011-3738

Exploit
  • EPSS 0.28%
  • Veröffentlicht 23.09.2011 23:55:03
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files.