CVE-2026-90497 is a cross-site scripting vulnerability in Fengoffice Feng Office versions up to 3.11.13.11. It affects the getTitle function in application/views/task/add_task.php related to task title output. Manipulating the og_objects.name argument allows an attacker to inject malicious scripts, potentially leading to reflected XSS attacks. The vulnerability can be exploited remotely. The vendor was notified but did not respond, and the exploit code has been publicly disclosed.

The vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the og_objects.name argument in the affected function. This can lead to limited impact such as injection of malicious scripts in the context of the affected web application, potentially affecting users who view the manipulated content. The CVSS score of 3.5 reflects a low impact with no confidentiality or availability impact and limited integrity impact.

No official patch or remediation has been provided by the vendor, and the vendor did not respond to the disclosure. Users should monitor vendor advisories for any future updates. Until a fix is available, consider applying input validation or output encoding workarounds to mitigate XSS risks in the affected component.