896 matches found
CVE-2020-12718
In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...
CVE-2020-12706
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faqadmin.php or shoutboxpanel/shoutboxadmin.php...
CVE-2010-4931
Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...
CVE-2014-8597
A reflected cross-site scripting XSS vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel...
CVE-2009-3119
SQL injection vulnerability in screen.php in the Download System mSF dsmsf module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the viewid parameter...
PT-2023-4770 · Unknown · Php-Fusion
Name of the Vulnerable Software and Affected Versions: PHPFusion affected versions not specified Description: The issue is related to insufficient sanitization of tainted file names that are directly concatenated with a path and subsequently passed to a require once statement. This allows arbitra...
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
Design/Logic Flaw
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
PT-2023-12160 · Unknown · Php-Fusion
Name of the Vulnerable Software and Affected Versions: Php-Fusion versions 9.03.90 through 9.10.00 Description: The issue allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. Recommendations: For Php-Fusion versions 9.03.90 through 9.09.99, update to...
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
CVE-2021-3172: Incorrect Permission Assignment for Critical Resource
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
CVE-2021-3172
The CVE-2021-3172 entry concerns Php-Fusion. The connected sources specify that Php-Fusion versions 9.03.90 through 9.10.00 are affected by a denial-of-service vulnerability exploitable by authenticated users via the Polling feature. The root cause is a DoS condition within the polling mechanism,...
CVE-2021-3172
An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature...
The vulnerability of the PHP-Fusion CMS, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to carry out XSS attacks.
The vulnerability of the PHP-Fusion CMS exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
PT-2022-4197
Name of the Vulnerable Software and Affected Versions PHP-Fusion affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the PHP-Fusion CMS system. This can be exploited by a remote attacker to conduct a cross-site scripting XSS attac...
PT-2022-4196
Name of the Vulnerable Software and Affected Versions PHP-Fusion affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the PHP-Fusion CMS system. Exploitation of this issue may allow a remote attacker to conduct a cross-site scripti...
CVE-2014-8597
A reflected cross-site scripting XSS vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel...