Threats tagged 'ghsa-m5h7-862j-4mgq'

A server-side request forgery (SSRF) vulnerability exists in Fengoffice Feng Office up to versions 3.11.13.11 and 4.2.1.2. The flaw is in the upload_document_image function of the FilesController.class.php file, allowing remote attackers to manipulate the 'url' argument to induce SSRF. Public exploit code is available, and the vendor has not responded to disclosure attempts.