XSS in Php-Fusion
CVE-2020-37152
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (16.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
- Php-Fusion — versions 9.03.50
- Php-Fusion Phpfusion — versions 9.03.50
Weakness classification (CWE)
References
- www.php-fusion.co.uk/ (Product, product)
- www.exploit-db.com/exploits/48299 (exploit, Not Applicable)
- www.vulncheck.com/advisories/php-fusion-panelsphp-cross-site-scripting-xss (Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2020-37152?
- CVE-2020-37152 is a medium-severity vulnerability in Php-Fusion, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-02-05.
- How severe is CVE-2020-37152?
- Medium severity. CVSS v3 base score is 6.1 out of 10.