Unscored severity · published Dec 28, 2005
CVE-2005-4516
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Php Fusion · Php Fusion
6.00.200; 6.00.204; 6.00.205; 6.00.206; 6.00.207; 6.00.300 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4516
Patch
http://secunia.com/advisories/18190/
securityreason.com
http://securityreason.com/securityalert/272
www.osvdb.org
http://www.osvdb.org/22048
www.osvdb.org
http://www.osvdb.org/22050
www.securityfocus.com
http://www.securityfocus.com/archive/1/420109/100/0/threaded
Exploit
http://www.securityfocus.com/bid/15931
More from Php Fusion
9.8
CVE-2020-37137
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
8.8
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command…
8.8
CVE-2020-12461
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism
8.8
CVE-2019-12099
In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and…
8.1
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature