Login Request a demo
PH
Product
PHP-Fusion
by PHP-Fusion · last CVE Feb 5, 2026
64
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities64In the news0Timeline
Severity mix
Critical 1High 5Medium 18Low 0
Severity
All severities64Critical1High5Medium18Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PHP-Fusion to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-24949
8.8
68%
Sep 3
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command…
Affected: 9.03.50
CVE-2020-12461
8.8
2%
Apr 29
PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism
Affected: 9.03.50
CVE-2019-12099
8.8
17%
May 14
In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and…
Affected: before 9.03.00
CVE-2021-3172
8.1
1%
Feb 17
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature
Affected: 9.03.90 before 9.10.00
CVE-2020-14960
7.2
2%
Jun 22
A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,
Affected: 9.03.50
Showing 5