{"action":"No fix published. Pin and monitor.","affected":[],"component":"feehi/feehicms","cve_ids":["CVE-2025-63520"],"ecosystem":"Packagist","epss":0.0024,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-c2vx-rx6x-m9wj","id":"tcs_01M5KF0FEQM3PMAEFVP4JMV86M","modified_at":"2025-12-02T18:06:32.065846Z","published_at":"2025-12-01T15:30:18Z","references":["https://osv.dev/vulnerability/GHSA-c2vx-rx6x-m9wj","https://nvd.nist.gov/vuln/detail/CVE-2025-63520","https://github.com/liufee/cms/issues/74","https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63520.md","https://github.com/liufee/cms"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-c2vx-rx6x-m9wj","url":"https://osv.dev/vulnerability/GHSA-c2vx-rx6x-m9wj"}],"summary":"FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function"}