Php-fusion PHP-Fusion 跨站脚本漏洞

PHP-Fusion is a lightweight open source content management system. A reflective cross-site scripting vulnerability exists in /administration/theme.php in PHP-Fusion version 9.03.60, which can be exploited to execute arbitrary web script or HTML via the "Manage Theme" field...

PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)

Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...

PHP-Fusion 9.03.90 Cross Site Request Forgery

Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

PHP-Fusion Security Vulnerability

Php-fusion PHP-Fusion is an open source lightweight content management system based on MySql and PHP from Malaysia's PHP-Fusion Php-fusion. The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion Andromeda version 9.x 2020-12-30, which stems from th...

PHP-Fusion Remote Command Execution (CVE-2020-24949)

A command execution vulnerability exists in PHP-Fusion. Successful exploitation of this vulnerability could allow a remote authenticated attacker to execute arbitrary commands on the affected system...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

Privilege escalation

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

CVE-2020-24949

CVE-2020-24949 affects PHP-Fusion 9.03.50 in downloads/downloads.php, where an authenticated non-admin user can send a crafted request to trigger remote code execution. The underlying issue enables arbitrary code execution on the server, with the vulnerability classified as high severity (CVSS v3...

CVE-2020-24949: Undefined Security Weakness

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

PHP-Fusion <= 9.03.60 XSS Vulnerability

PHP-Fusion is prone to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

PHP-Fusion Cross-Site Scripting Vulnerability (CNVD-2020-49953)

PHP-Fusion is a lightweight open source content management system. PHP-Fusion 9.03.60 suffers from a cross-site scripting vulnerability that can be exploited by attackers via infusions/memberpollpanel/polladmin.php...

CVE-2020-23658

PHP-Fusion 9.03.60 is affected by Cross Site Scripting XSS via infusions/memberpollpanel/polladmin.php...

CVE-2020-23658

PHP-Fusion 9.03.60 is affected by Cross Site Scripting XSS via infusions/memberpollpanel/polladmin.php...

Cross site scripting

PHP-Fusion 9.03.60 is affected by Cross Site Scripting XSS via infusions/memberpollpanel/polladmin.php...

CVE-2020-23658

Summary: CVE-2020-23658 affects PHP-Fusion 9.03.60 with a Cross Site Scripting (XSS) vulnerability exploitable via infusions/member_poll_panel/poll_admin.php. Affected software: PHP-Fusion 9.03.60 (admin/poll panel infusion). Root cause / impact: XSS vulnerability; impact details state confidenti...

CVE-2020-23658

PHP-Fusion 9.03.60 is affected by Cross Site Scripting XSS via infusions/memberpollpanel/polladmin.php...

CVE-2020-23658: Improper Neutralization of Input During Web Page Generation

PHP-Fusion 9.03.60 is affected by Cross Site Scripting XSS via infusions/memberpollpanel/polladmin.php...

PHP-Fusion < 9.03.30 Multiple XSS Vulnerabilities

PHP-Fusion is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...