Filtered by vendor Php-fusion
Subscriptions
Filtered by product Php-fusion
Subscriptions
Total
45 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-12706 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 5.4 Medium |
| Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | ||||
| CVE-2020-12461 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 8.8 High |
| PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query. | ||||
| CVE-2020-12438 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 5.4 Medium |
| An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | ||||
| CVE-2019-12099 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | N/A |
| In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. | ||||
| CVE-2015-8375 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | N/A |
| Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. | ||||