Code injection

In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...

CVE-2019-12099

In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...

CVE-2019-12099

CVE-2019-12099 affects PHP-Fusion 9.03.00. The vulnerability is in edit_profile.php where remote authenticated users can execute arbitrary code due to mishandling of executable files during avatar uploads in includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Li...

PHP-Fusion 9.03.00 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusion 9.03.00 and prior versions. It is possible to execute commands i...

CVE-2019-12099: Unrestricted Upload of File with Dangerous Type

In PHP-Fusion 9.03.00, editprofile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/formfileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload...

PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution (Metasploit)

PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusi...

PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusion 9.03.00 and prior versions. It is possible to execute commands i...

Cross site scripting

Cross-site scripting XSS vulnerability in PHP-Fusion 9...

CVE-2015-8375

Cross-site scripting XSS vulnerability in PHP-Fusion 9...

CVE-2015-8375

Cross-site scripting XSS vulnerability in PHP-Fusion 9...

CVE-2015-8375

CVE-2015-8375 is a cross-site scripting (XSS) vulnerability affecting PHP-Fusion 9. OpenVAS describes PHPFusion

CVE-2015-8375: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in PHP-Fusion 9...

PHP-Fusion 'administration/robots.php' HTML Injection Vulnerability

PHP-Fusion is an open source lightweight content management system based on MySql and PHP. An HTML injection vulnerability exists in PHP-Fusion, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

PHP-Fusion 7.02.07 - Blind SQL Injection

PHP-Fusion 7.02.07 - Blind SQL Injection ============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

PHP-Fusion 7.02.07 Blind SQL Injection Vulnerability

PHP-Fusion versions 7.02.07 and below suffer from a remote blind SQL injection vulnerability in the admin panel. ============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas -...

PHP-Fusion 7.02.07 Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

PHP-Fusion 7.02.07 - Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

PHP Fusion 7.02.07 XSS / Clickjacking

Hi Team, Affected Vendor: https://www.php-fusion.co.uk/home.php Date: 04/05/2015 Creditee: http://osvdb.org/creditees/13518-vadodil-joel-varghese Type of vulnerability: Persistent XSS + Clickjacking Tested on: Windows 8.1 Product: PHP Fusion Version: 7.02.07 1 Cross Site Scripting...

PHP-Fusion 7.02.07 /administration/submissions.php SQL注入漏洞

/administration/submissions.phpif isset$GET'action' && $GET'action' == "2" && isset$GET't' && $GET't' == "n" if isset$POST'publish' && isset$GET'submitid' && isnum$GET'submitid' $result = dbquery"SELECT ts., tu.userid, tu.username FROM ".DBSUBMISSIONS." ts LEFT JOIN ".DBUSERS." tu ON...

PHP-Fusion Multiple SQL Injections (CVE-2014-8596)

SQL injection vulnerability has been reported in PHP-Fusion. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...