CVE-2026-90495 | Fengoffice Feng Office up to 3.11.13.11 Legacy API CompanyWebsite.class.php instance->findAll auth sql injection

SecurityVulns
Yanac

A vulnerability categorized as critical has been discovered in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-90495. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More