Browse CVEs

MEDIUM 6.1 CVE-2020-37152 PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly s… Phpfusion No fix yet Fix from $1,6002026-02-05 CRITICAL 9.8 CVE-2020-37137 PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code … Phpfusion Mitigation only Fix from $2,3002026-02-05 MEDIUM 6.1 CVE-2023-53928 PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with e… Phpfusion No fix yet Fix from $1,6002025-12-17 HIGH 8.8 CVE-2023-2453 There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ s… Phpfusion after 9.10.30 Fix from $1,9502023-09-05 MEDIUM 5.5 CVE-2023-4480 Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request th… Phpfusion after 9.10.30 Fix from $1,6002023-09-05 HIGH 8.1 CVE-2021-3172 An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. Php Fusion 9.10.00+ Fix from $1,9502023-02-17 HIGH 8.8 CVE-2022-3152 Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. Phpfusion 9.10.20+ Fix from $1,9502022-09-07 MEDIUM 6.1 CVE-2014-8597 A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the sta… Phpfusion No fix yet Fix from $1,6002022-02-17 CRITICAL 9.6 CVE-2020-23754 Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary c… Phpfusion Mitigation only Fix from $2,3002021-11-02 HIGH 7.2 CVE-2021-40188 PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions… Phpfusion No fix yet Fix from $1,9502021-10-11 HIGH 7.2 CVE-2021-40189 PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], wh… Phpfusion No fix yet Fix from $1,9502021-10-11 MEDIUM 6.1 CVE-2021-40541 PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticate… Phpfusion No fix yet Fix from $1,6002021-10-11 MEDIUM 5.4 CVE-2020-23178 An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session repla… Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 5.4 CVE-2020-23179 A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute… Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 5.4 CVE-2020-23181 A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arb… Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 5.4 CVE-2020-23182 The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious … Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 5.4 CVE-2020-23184 A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers t… Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 5.4 CVE-2020-23185 A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to exe… Php Fusion No fix yet Fix from $1,6002021-07-02 MEDIUM 6.1 CVE-2021-28280 CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML Phpfusion Patch available Fix from $1,6002021-04-29 MEDIUM 6.5 CVE-2020-35952 login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and inco… Php Fusion 9.03.90+ Fix from $1,6002021-01-03 HIGH 8.8 CVE-2020-24949EPSS 68% Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server a… Php Fusion No fix yet Fix from $1,9502020-09-03 MEDIUM 5.4 CVE-2020-23658 PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. Php Fusion No fix yet Fix from $1,6002020-08-26 MEDIUM 6.1 CVE-2020-17450 PHP-Fusion 9.03 allows XSS on the preview page. Php Fusion after 9.03 Fix from $1,6002020-08-12 MEDIUM 5.4 CVE-2020-17449 PHP-Fusion 9.03 allows XSS via the error_log file. Php Fusion after 9.03 Fix from $1,6002020-08-12 HIGH 7.2 CVE-2020-14960 A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, Php Fusion Patch available Fix from $1,9502020-06-22 MEDIUM 5.4 CVE-2020-12718 In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comme… Php Fusion No fix yet Fix from $1,6002020-05-08 MEDIUM 6.1 CVE-2020-12708 Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id para… Php Fusion No fix yet Fix from $1,6002020-05-07 MEDIUM 5.4 CVE-2020-12706 Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go paramete… Php Fusion Patch available Fix from $1,6002020-05-07 HIGH 8.8 CVE-2020-12461 PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that… Php Fusion Patch available Fix from $1,9502020-04-29 MEDIUM 5.4 CVE-2020-12438 An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS i… Php Fusion Patch available Fix from $1,6002020-04-28