CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/07/2021 |
| CVE-2020-23182 | MEDIUM5.4 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel. | 02/07/2021 |
| CVE-2020-23181 | MEDIUM5.4 | A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field. | 02/07/2021 |
| CVE-2020-23179 | MEDIUM5.4 | A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field. | 02/07/2021 |
| CVE-2020-23178 | MEDIUM5.4 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user. | 02/07/2021 |
| CVE-2020-35952 | MEDIUM6.5 | login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration. | 03/01/2021 |
| CVE-2020-24949 | HIGH8.8 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). | 03/09/2020 |
| CVE-2020-23658 | MEDIUM5.4 | PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. | 26/08/2020 |
| CVE-2020-17450 | MEDIUM6.1 | PHP-Fusion 9.03 allows XSS on the preview page. | 12/08/2020 |
| CVE-2020-17449 | MEDIUM5.4 | PHP-Fusion 9.03 allows XSS via the error_log file. | 12/08/2020 |
| CVE-2020-15041 | MEDIUM4.8 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. | 24/06/2020 |
| CVE-2020-14960 | HIGH7.2 | A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, | 22/06/2020 |
| CVE-2020-12718 | MEDIUM5.4 | In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle. | 08/05/2020 |
| CVE-2020-12708 | MEDIUM6.1 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. | 07/05/2020 |
| CVE-2020-12706 | MEDIUM5.4 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | 07/05/2020 |
| CVE-2020-12461 | HIGH8.8 | PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the | 29/04/2020 |
| CVE-2020-12438 | MEDIUM5.4 | An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | 28/04/2020 |