812 matches found
CVE-2020-23178
CVE-2020-23178 affects PHP-Fusion 9.03.50. The issue is that session cookies are not deleted when a user logs out, enabling a session replay attack and impersonation of the victim. Public references (NVD/RH/CVE records) confirm the affected product and the underlying cause (logout cookie not clea...
CVE-2020-23178
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user...
PHP-Fusion 安全漏洞
PHP-Fusion is a Malaysian company PHP-Fusion open source lightweight content management system based on MySql and PHP . The system contains modules such as news, articles and forums. PHP-Fusion suffers from a security vulnerability that stems from a session cookie not being deleted when a user lo...
Php-fusion PHP-Fusion 输入验证错误漏洞
Php-fusion PHP-Fusion is an open source lightweight content management system based on MySql and PHP from Malaysia's PHP-Fusion Php-fusion. The system contains modules for news, articles and forums. PHP-Fusion suffers from an injection vulnerability that stems from a flaw in a component in...
Php-fusion PHP-Fusion 跨站脚本漏洞
PHP-Fusion is a lightweight open source content management system. A reflective cross-site scripting vulnerability exists in /administration/theme.php in PHP-Fusion version 9.03.60, which can be exploited to execute arbitrary web script or HTML via the "Manage Theme" field...
Php-fusion PHP-Fusion跨站脚本漏洞
PHP-Fusion is a lightweight open source content management system. A stored cross-site scripting vulnerability exists in /administration/settingsregistration.php in PHP-Fusion version 9.03.60, which can be exploited to execute arbitrary web script or HTML via the "registration" field...
Php-fusion PHP-Fusion 跨站脚本漏洞
PHP-Fusion is a lightweight open source content management system. A stored cross-site scripting vulnerability exists in administration/settingsmain.php in PHP-Fusion, which can be exploited to execute arbitrary web script or HTML via the "site footer" field...
PHP-Fusion 9.03.90 Cross Site Request Forgery
Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...
PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...
CVE-2020-35952
login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...
PHP-Fusion Security Vulnerability
Php-fusion PHP-Fusion is an open source lightweight content management system based on MySql and PHP from Malaysia's PHP-Fusion Php-fusion. The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion Andromeda version 9.x 2020-12-30, which stems from th...
PHP-Fusion Remote Command Execution (CVE-2020-24949)
A command execution vulnerability exists in PHP-Fusion. Successful exploitation of this vulnerability could allow a remote authenticated attacker to execute arbitrary commands on the affected system...
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...
Privilege escalation
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...
CVE-2020-24949
CVE-2020-24949 affects PHP-Fusion 9.03.50 in downloads/downloads.php, where an authenticated non-admin user can send a crafted request to trigger remote code execution. The underlying issue enables arbitrary code execution on the server, with the vulnerability classified as high severity (CVSS v3...
PHP-Fusion <= 9.03.60 XSS Vulnerability
PHP-Fusion is prone to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
PHP-Fusion Cross-Site Scripting Vulnerability (CNVD-2020-49953)
PHP-Fusion is a lightweight open source content management system. PHP-Fusion 9.03.60 suffers from a cross-site scripting vulnerability that can be exploited by attackers via infusions/memberpollpanel/polladmin.php...
