CVE-2021-36572

Name of the Vulnerable Software and Affected Versions Feehi CMS versions 2.1.1 and earlier

Description The issue allows attackers to run arbitrary code via the user name field of the "/login" API endpoint. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized access or control.

Recommendations For Feehi CMS versions 2.1.1 and earlier, as a temporary workaround, consider restricting access to the login page or validating and sanitizing the user name field to prevent malicious code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.