Php-Fusion Phpfusion
14 CVEs affecting Php-Fusion Phpfusion. Latest disclosed: 2026-02-05. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-23754 | Critical | 9.6 | 2021-11-02 | Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via t… |
CVE-2023-2453 | High | 8.8 | 2023-09-05 | There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement… |
CVE-2022-3152 | High | 8.8 | 2022-09-07 | Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. |
CVE-2021-40189 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an att… |
CVE-2021-40188 | High | 7.2 | 2021-10-11 | PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as "… |
CVE-2020-36996 | Medium | 6.4 | 2026-01-30 | PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content… |
CVE-2020-37152 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize us… |
CVE-2020-37137 | Medium | 6.1 | 2026-02-05 | PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an… |
CVE-2014-8597 | Medium | 6.1 | 2022-02-17 | A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parame… |
CVE-2021-40541 | Medium | 6.1 | 2021-10-11 | PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can… |
CVE-2021-28280 | Medium | 6.1 | 2021-04-29 | CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML |
CVE-2023-4480 | Medium | 5.5 | 2023-09-05 | Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows… |
CVE-2023-53928 | Medium | 5.4 | 2025-12-17 | PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded Ja… |
CVE-2020-35687 | Medium | 4.3 | 2021-01-13 | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |