Php-Fusion
31 CVEs across 10 Php-Fusion products. Browse Php-Fusion vulnerabilities, severities, and proof-of-concept exploits.
Php-Fusion products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37152 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize us… |
CVE-2020-37137 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an… |
CVE-2020-36996 | Medium | 6.4 | 2026-01-30 | PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content… |
CVE-2023-53928 | Medium | 5.4 | 2025-12-17 | PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded Ja… |
CVE-2023-4480 | Medium | 5.5 | 2023-09-05 | Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows… |
CVE-2023-2453 | High | 8.8 | 2023-09-05 | There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement… |
CVE-2021-3172 | High | 8.1 | 2023-02-17 | An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. |
CVE-2022-3152 | High | 8.8 | 2022-09-07 | Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. |
CVE-2014-8597 | Medium | 6.1 | 2022-02-17 | A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parame… |
CVE-2020-23754 | Critical | 9.6 | 2021-11-02 | Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via t… |
CVE-2021-40189 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an att… |
CVE-2021-40188 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as "… |
CVE-2021-40541 | Medium | 6.1 | 2021-10-11 | PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can… |
CVE-2020-23702 | Medium | 4.8 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php. |
CVE-2020-23185 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbit… |
CVE-2020-23184 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute… |
CVE-2020-23182 | Medium | 5.4 | 2021-07-02 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites v… |
CVE-2020-23181 | Medium | 5.4 | 2021-07-02 | A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web… |
CVE-2020-23179 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary… |
CVE-2020-23178 | Medium | 5.4 | 2021-07-02 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack a… |
CVE-2021-28280 | Medium | 6.1 | 2021-04-29 | CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML |
CVE-2020-35687 | Medium | 4.3 | 2021-01-13 | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |
CVE-2020-35952 | Medium | 6.5 | 2021-01-03 | login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect pass… |
CVE-2020-24949 | High | 8.8 | 2020-09-03 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform… |
CVE-2020-23658 | Medium | 5.4 | 2020-08-26 | PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. |
CVE-2020-17450 | Medium | 6.1 | 2020-08-12 | PHP-Fusion 9.03 allows XSS on the preview page. |
CVE-2020-17449 | Medium | 5.4 | 2020-08-12 | PHP-Fusion 9.03 allows XSS via the error_log file. |
CVE-2020-15041 | Medium | 4.8 | 2020-06-24 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. |
CVE-2020-14960 | High | 7.2 | 2020-06-22 | A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, |
CVE-2020-12718 | Medium | 5.4 | 2020-05-08 | In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature… |
CVE-2020-12708 | Medium | 6.1 | 2020-05-07 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to d… |
CVE-2020-12706 | Medium | 5.4 | 2020-05-07 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/f… |
CVE-2020-12461 | High | 8.8 | 2020-04-29 | PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be in… |
CVE-2020-12438 | Medium | 5.4 | 2020-04-28 | An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stri… |
CVE-2019-12099 | High | 8.8 | 2019-05-14 | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and i… |
CVE-2015-8375 | Medium | 5.4 | 2017-09-25 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. |
CVE-2014-8596 | | 2014-11-17 | Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter… | |
CVE-2013-7375 | | 2014-05-05 | SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL c… | |
CVE-2013-1803 | | 2014-05-05 | Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to d… | |
CVE-2013-1807 | | 2014-04-30 | PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote att… | |
CVE-2013-1806 | | 2014-04-30 | Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot… | |
CVE-2013-1804 | | 2014-04-29 | Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) high… | |
CVE-2012-6043 | | 2012-11-26 | Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id p… | |
CVE-2010-4931 | | 2011-10-09 | Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the… | |
CVE-2010-4791 | | 2011-04-27 | SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) module 1.0.1 for PHP-… | |
CVE-2011-0512 | | 2011-01-20 | SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the team… | |
CVE-2009-4889 | | 2010-06-11 | SQL injection vulnerability in books.php in the Book Panel (book_panel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the… | |
CVE-2009-3119 | | 2009-09-09 | SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands vi… | |
CVE-2008-6850 | | 2009-07-07 | Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via un… | |
CVE-2009-0832 | | 2009-03-05 | SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter. | |
CVE-2009-0831 | | 2009-03-05 | SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated us… | |
CVE-2008-5946 | | 2009-01-22 | SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter. | |
CVE-2008-5733 | | 2008-12-26 | SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the… | |
CVE-2008-5335 | | 2008-12-05 | SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary S… | |
CVE-2008-5197 | | 2008-11-21 | SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_advert… | |
CVE-2008-5196 | | 2008-11-21 | SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL comma… | |
CVE-2008-5074 | | 2008-11-14 | SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the link… | |
CVE-2008-4527 | | 2008-10-09 | SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the… | |
CVE-2008-4521 | | 2008-10-09 | SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion allows remote attac… | |
CVE-2008-2227 | | 2008-05-14 | Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. (do… | |
CVE-2008-1918 | | 2008-04-23 | SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows… | |
CVE-2007-5187 | | 2007-10-03 | SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to ex… | |
CVE-2007-3559 | | 2007-07-04 | Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows… |