Login Request a demo
PH
Vendor
PHP-Fusion
11 products with CVEs on record
88
CVEs
0
On KEV
0
New 30D
Products
PH
PHP-Fusion
PHP-Fusion
9.8
64 CVEs0 on KEV0 new
PH
PHPFusion
Php-fusion
9.8
14 CVEs0 on KEV0 new
EC
Expanded Calendar Module
Php Fusion
–
2 CVEs0 on KEV0 new
AM
Arcade Module
Php Fusion
–
1 CVEs0 on KEV0 new
FR
Forum Rank System
Php-fusion
–
1 CVEs0 on KEV0 new
FM
Freshlinks Module
Php-fusion
–
1 CVEs0 on KEV0 new
MC
Members CV Module
Php-fusion
–
1 CVEs0 on KEV0 new
RM
Recepies Module
Php-fusion
–
1 CVEs0 on KEV0 new
TI
Team Impact TI Blog System Module
Php-fusion
–
1 CVEs0 on KEV0 new
TK
The Kroax Module
Php-fusion
–
1 CVEs0 on KEV0 new
WO
World OF Warcraft Tracker Infusion Module
Php-fusion
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2020-37152
PH
PHP-Fusion
PHP-Fusion
6.1
0%
Feb 5PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
CVE-2020-37137
PF
PHP Fusion
PHP Fusion
9.8
1%
Feb 5PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
CVE-2020-36996
PH
PHPFusion
Php-Fusion
6.4
0%
Jan 30PHPFusion 9.03.50 - Persistent Cross-Site Scripting
CVE-2023-53928
PH
PHPFusion
Php-fusion
6.1
0%
Dec 17PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
CVE-2023-4480
PH
Phpfusion
Php-fusion
5.5
1%
Sep 5Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the…
CVE-2023-2453
PH
Phpfusion
Php-fusion
8.8
1%
Sep 5There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement
CVE-2021-3172
PH
Php-fusion
Php-fusion
8.1
1%
Feb 17An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature
CVE-2022-3152
PH
Phpfusion
Php-fusion
8.8
1%
Sep 7Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20
CVE-2014-8597
PH
Phpfusion
Php-fusion
6.1
1%
Feb 17A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin…
CVE-2020-23754
PH
Phpfusion
Php-fusion
9.6
2%
Nov 2Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature
CVE-2021-40189
PH
Phpfusion
Php-fusion
7.2
2%
Oct 11PHPFusion 9.03.110 is affected by a remote code execution vulnerability
CVE-2021-40188
PH
Phpfusion
Php-fusion
7.2
1%
Oct 11PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability
CVE-2021-40541
PH
Phpfusion
Php-fusion
6.1
1%
Oct 11PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by…
CVE-2020-23702
PH
Php-fusion
Php-fusion
4.8
1%
Jul 7Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php
CVE-2020-23185
PH
Php-fusion
Php-fusion
5.4
0%
Jul 2A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or…
CVE-2020-23184
PH
Php-fusion
Php-fusion
5.4
0%
Jul 2A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web…
CVE-2020-23182
PH
Php-fusion
Php-fusion
5.4
1%
Jul 2The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload…
CVE-2020-23181
PH
Php-fusion
Php-fusion
5.4
0%
Jul 2A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via…
CVE-2020-23179
PH
Php-fusion
Php-fusion
5.4
0%
Jul 2A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML…
CVE-2020-23178
PH
Php-fusion
Php-fusion
5.4
1%
Jul 2An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the…
CVE-2021-28280
PH
Phpfusion
Php-fusion
6.1
1%
Apr 29CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CVE-2020-35687
PH
Phpfusion
Php-fusion
4.3
1%
Jan 13PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim
CVE-2020-35952
PH
Php-fusion
Php-fusion
6.5
1%
Jan 3login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a…
CVE-2020-24949
PH
Php-fusion
Php-fusion
8.8
68%
Sep 3Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command…
CVE-2020-23658
PH
Php-fusion
Php-fusion
5.4
0%
Aug 26PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php
CVE-2020-17450
PH
Php-fusion
Php-fusion
6.1
1%
Aug 12PHP-Fusion 9.03 allows XSS on the preview page
CVE-2020-17449
PH
Php-fusion
Php-fusion
5.4
1%
Aug 12PHP-Fusion 9.03 allows XSS via the error_log file
CVE-2020-15041
PH
Php-fusion
Php-fusion
4.8
1%
Jun 24PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field
CVE-2020-14960
PH
Php-fusion
Php-fusion
7.2
2%
Jun 22A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,
CVE-2020-12718
PH
Php-fusion
Php-fusion
5.4
1%
May 8In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature
CVE-2020-12708
PH
Php-fusion
Php-fusion
6.1
1%
May 7Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to…
CVE-2020-12706
PH
Php-fusion
Php-fusion
5.4
3%
May 7Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or…
CVE-2020-12461
PH
Php-fusion
Php-fusion
8.8
2%
Apr 29PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism
CVE-2020-12438
PH
Php-fusion
Php-fusion
5.4
1%
Apr 28An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50
CVE-2019-12099
PH
Php-fusion
Php-fusion
8.8
17%
May 14In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and…
CVE-2015-8375
PH
Php-fusion
Php-fusion
5.4
1%
Sep 25Cross-site scripting (XSS) vulnerability in PHP-Fusion 9
CVE-2014-8596
PH
Php-fusion
Php-fusion
–
3%
Nov 17Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to…
CVE-2013-7375
PH
Php-fusion
Php-fusion
–
4%
May 5SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user…
CVE-2013-1803
PH
Php-fusion
Php-fusion
–
4%
May 5Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or…
CVE-2013-1807
PH
Php-fusion
Php-fusion
–
8%
Apr 30PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain…
CVE-2013-1806
PH
Php-fusion
Php-fusion
–
8%
Apr 30Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a
CVE-2013-1804
PH
Php-fusion
Php-fusion
–
4%
Apr 29Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to…
CVE-2012-6043
PH
Php-fusion
Php-fusion
–
2%
Nov 26Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter
CVE-2010-4931
PH
Php-fusion
Php-fusion
–
16%
Oct 9Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a
CVE-2008-6850
PH
Php-fusion
Php-fusion
–
1%
Jul 7Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
CVE-2009-0831
MC
Members CV Module
Php-fusion
–
1%
Mar 5SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated users to execute…
CVE-2008-5946
PH
Php-fusion
Php-fusion
–
1%
Jan 22SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter
CVE-2008-5733
TI
Team Impact TI Blog System Module
Php-fusion
–
1%
Dec 26SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the id parameter
CVE-2008-5335
PH
Php-fusion
Php-fusion
–
3%
Dec 5SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the…
CVE-2008-5197
PH
Php-fusion
Php-fusion
–
4%
Nov 21SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_adverts action
CVE-2008-5196
TK
The Kroax Module
Php-fusion
–
1%
Nov 21SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the category…
CVE-2008-5074
FM
Freshlinks Module
Php-fusion
–
1%
Nov 14SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter
CVE-2008-4527
RM
Recepies Module
Php-fusion
–
1%
Oct 9SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the kat_id parameter in…
CVE-2008-4521
WO
World OF Warcraft Tracker Infusion Module
Php-fusion
–
1%
Oct 9SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion allows remote attackers to execute…
CVE-2008-2227
FR
Forum Rank System
Php-fusion
–
2%
May 14Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a
CVE-2008-1918
PH
Php-fusion
Php-fusion
–
1%
Apr 23SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated…
CVE-2007-5187
EC
Expanded Calendar Module
Php-fusion
–
4%
Oct 3SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL…
CVE-2007-3559
PH
Php-fusion
Php-fusion
–
1%
Jul 4Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated…
CVE-2007-1978
AM
Arcade Module
Php Fusion
–
1%
Apr 12SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter in a…
CVE-2007-1845
EC
Expanded Calendar Module
Php Fusion
–
1%
Apr 3SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via…