CVE-2026-90497

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12

Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle() function located in the application/views/task/add task.php file. An attacker can trigger this by manipulating the og objects.name variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.