CVE-2026-90495: Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Fengoffice Feng Office deployments using the Legacy API are affected through version 3.11.13.11. The vulnerable code is the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the auth argument supplied to the Legacy API. No privileges or user interaction are required according to the provided severity vector.
Is public exploitation a concern?
Yes. An exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information does not identify a fixed version or workaround. It states that the vendor was contacted early but did not respond.