Login Request a demo
PH
Product
PHPFusion
by Php-fusion · last CVE Feb 5, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 2High 4Medium 8Low 0
Severity
All severities14Critical2High4Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PHPFusion to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-36996
6.4
0%
Jan 30
PHPFusion 9.03.50 - Persistent Cross-Site Scripting
Affected: through 9.03.50
CVE-2020-37152
6.1
0%
Feb 5
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
Affected: 9.03.50
CVE-2023-53928
6.1
0%
Dec 17
PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
Affected: 9.10.30
CVE-2014-8597
6.1
1%
Feb 17
A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin…
Affected: 7.02.07
CVE-2021-40541
6.1
1%
Oct 11
PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by…
Affected: 9.03.110
CVE-2021-28280
6.1
1%
Apr 29
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Affected: 9.03.110
CVE-2023-4480
5.5
1%
Sep 5
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the…
Affected: through 9.10.30
CVE-2020-35687
4.3
1%
Jan 13
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim
Affected: 9.03.90
Showing 8