Medium severity · published Dec 17, 2025
CVE-2023-53928
PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload SVG files with script tags that execute arbitrary JavaScript when viewed, potentially stealing user session information or performing client-side attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHPFusion · Php-fusion
9.10.30 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53928
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53928
Exploit
https://www.exploit-db.com/exploits/51411
Product
https://www.phpfusion.com/index.php
Third Party Advisory
https://www.vulncheck.com/advisories/phpfusion-stored-cross-site-scripting-via-file-manager-upload
More from PHPFusion
9.8
CVE-2020-37137
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
9.6
CVE-2020-23754
Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature
8.8
CVE-2023-2453
There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement
8.8
CVE-2022-3152
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20
7.2
CVE-2021-40189
PHPFusion 9.03.110 is affected by a remote code execution vulnerability