XSS in Php-Fusion
CVE-2020-37152
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Php-fusion — versions 9.03.50
- Php-fusion Phpfusion — versions 9.03.50
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Product, product)
- disclosure@vulncheck.com (exploit, Not Applicable)
- disclosure@vulncheck.com (Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2020-37152?
- CVE-2020-37152 is a medium-severity vulnerability in Php-Fusion, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-02-05.
- How severe is CVE-2020-37152?
- Medium severity. CVSS v3 base score is 6.1 out of 10.