CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2020-23658 |
| 보통5.4 |
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. |
| 26/08/2020 |
| CVE-2020-17450 | 보통6.1 | PHP-Fusion 9.03 allows XSS on the preview page. | 12/08/2020 |
| CVE-2020-17449 | 보통5.4 | PHP-Fusion 9.03 allows XSS via the error_log file. | 12/08/2020 |
| CVE-2020-15041 | 보통4.8 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. | 24/06/2020 |
| CVE-2020-14960 | 높음7.2 | A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, | 22/06/2020 |
| CVE-2020-12718 | 보통5.4 | In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle. | 08/05/2020 |
| CVE-2020-12708 | 보통6.1 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. | 07/05/2020 |
| CVE-2020-12706 | 보통5.4 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | 07/05/2020 |
| CVE-2020-12461 | 높음8.8 | PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the | 29/04/2020 |
| CVE-2020-12438 | 보통5.4 | An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | 28/04/2020 |
| CVE-2019-12099 | 높음8.8 | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. | 14/05/2019 |
| CVE-2015-8375 | 보통5.4 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. | 25/09/2017 |
| CVE-2014-8596 | 높음7.5 | Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php. | 17/11/2014 |
| CVE-2013-7375 | 높음7.5 | SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803. | 05/05/2014 |
| CVE-2013-1803 | 높음7.5 | Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in | 05/05/2014 |
| CVE-2013-1807 | 보통5.0 | PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/. | 30/04/2014 |
| CVE-2013-1806 | 보통6.5 | Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administr | 30/04/2014 |