Medium severity · published Feb 5, 2026
CVE-2020-37152
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP-Fusion · PHP-Fusion
9.03.50 · source: vendor
PH
Phpfusion · Php-fusion
9.03.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37152
Not Applicable
https://www.exploit-db.com/exploits/48299
Product
https://www.php-fusion.co.uk/
Broken Link
https://www.vulncheck.com/advisories/php-fusion-panelsphp-cross-site-scripting-xss
More from PHP-Fusion
9.8
CVE-2020-37137
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
8.8
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command…
8.8
CVE-2020-12461
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism
8.8
CVE-2019-12099
In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and…
8.1
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature