CVE-2020-14960

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,...

CVE-2020-14960: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,...

PT-2020-14089

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description A SQL injection issue affects the "administration/comments.php" endpoint via the ctype parameter. Recommendations For PHP-Fusion version 9.03.50, avoid using the ctype parameter in the affected endpoint...

CVE-2020-12718

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

CVE-2020-12718: Improper Neutralization of Input During Web Page Generation

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

PT-2020-13226

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue concerns a stored XSS vulnerability in the Preview Comment feature of the administration/comments.php file. An authenticated attacker can exploit this by bypassing the protection mechanism using...