eehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
| Link | Resource |
|---|---|
| https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md | Exploit Third Party Advisory |
| https://github.com/liufee/cms/issues/78 | Exploit Third Party Advisory |
19 Dec 2025, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:feehi:feehicms:2.1.1:*:*:*:*:*:*:* | |
| First Time |
Feehi
Feehi feehicms |
|
| References | () https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md - Exploit, Third Party Advisory | |
| References | () https://github.com/liufee/cms/issues/78 - Exploit, Third Party Advisory |
02 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
02 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-12-02 21:15
Updated : 2025-12-19 18:18
NVD link : CVE-2025-65657
Mitre link : CVE-2025-65657
CVE.ORG link : CVE-2025-65657
JSON object : View
Improper Neutralization of Special Elements used in a Command ('Command Injection')