CVE-2026-36669Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Rıdvan Yağlı@ridvanyagli46d
Disclosure
🚨 Feng Office'de 2 kritik güvenlik açığı! Feng Office 3.11.13.11 ve öncesini etkileyen iki farklı güvenlik açığı bulunuyor: 🔴 CVE-2026-36669 | CVSS 9.8 Critical Kimlik doğrulaması gerektirmeyen Arbitrary File Upload açığı. Saldırganın web üzerinden dosya yüklemesine izin verebiliyor. 🟠 CVE-2026-90495 | CVSS 7.3 High Kimlik doğrulaması gerektirmeyen SQL Injection açığı. Legacy API'deki auth parametresinin işlenmesiyle ilişkili. 📌 Etkilenen sürümler: Feng Office ≤ 3.11.13.11 📌 Her iki açık da uzaktan ve kimlik doğrulaması olmadan istismar edilebiliyor. İnternete açık Feng Office sürümlerinizi güncelleyin.
Post summary
The text is a vulnerability disclosure announcing two critical security flaws in Feng Office (CVE-2026-36669 and CVE-2026-90495) with CVSS scores and technical descriptions, recommending updates without specifying a named patch or PoC.
01051612
2.5K followersView on X

Explore more

Back to dashboard