Filtered by vendor Php-fusion
Subscriptions
Filtered by product Php-fusion
Subscriptions
Total
45 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-12718 | 1 Php-fusion | 1 Php-fusion | 2024-08-04 | 5.4 Medium |
| In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle. | ||||
| CVE-2020-12708 | 1 Php-fusion | 1 Php-fusion | 2024-08-04 | 6.1 Medium |
| Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. | ||||
| CVE-2020-12461 | 1 Php-fusion | 1 Php-fusion | 2024-08-04 | 8.8 High |
| PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the ORDER BY clause in the SQL query. | ||||
| CVE-2020-12438 | 1 Php-fusion | 1 Php-fusion | 2024-08-04 | 5.4 Medium |
| An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | ||||
| CVE-2021-3172 | 1 Php-fusion | 1 Php-fusion | 2024-08-03 | 8.1 High |
| An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. | ||||