Lucene search

K

Fusion Security Vulnerabilities

cve
cve

CVE-2010-4931

Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level parameter. NOTE: this issue has been disputed by a reliable third...

7.4AI Score

0.038EPSS

2022-10-03 04:21 PM
25
cve
cve

CVE-2022-1386

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the...

9.8CVSS

9.1AI Score

0.222EPSS

2022-05-16 03:15 PM
434
5
cve
cve

CVE-2005-1596

index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the is_logged parameter or execute arbitrary code via the maxname2...

7.9AI Score

0.082EPSS

2005-05-16 04:00 AM
27
cve
cve

CVE-2005-2074

Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post, possibly involving the (1) news_body, (2) article_description, or (3) article_body parameters to...

5.8AI Score

0.002EPSS

2005-06-29 04:00 AM
55
cve
cve

CVE-2005-2075

PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0.....

6.3AI Score

0.017EPSS

2005-06-29 04:00 AM
27
cve
cve

CVE-2005-3159

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msg_view parameter, a different vulnerability than CVE-2005-3157 and...

8.3AI Score

0.003EPSS

2005-10-06 10:02 AM
26
cve
cve

CVE-2020-36711

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

6.4CVSS

5.2AI Score

0.001EPSS

2023-06-07 02:15 AM
12
cve
cve

CVE-2023-2453

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known.....

8.8CVSS

8.6AI Score

0.001EPSS

2023-09-05 03:15 PM
16
cve
cve

CVE-2023-4480

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write...

5.5CVSS

6.1AI Score

0.001EPSS

2023-09-05 03:15 PM
17
cve
cve

CVE-2021-3172

An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling...

8.1CVSS

7.7AI Score

0.001EPSS

2023-02-17 06:15 PM
20
cve
cve

CVE-2022-41996

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin...

8.8CVSS

8.8AI Score

0.001EPSS

2022-10-27 05:15 PM
32
4
cve
cve

CVE-2009-3119

SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the view_id...

8.7AI Score

0.002EPSS

2022-10-03 04:23 PM
25
cve
cve

CVE-2022-3152

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to...

8.8CVSS

8.7AI Score

0.001EPSS

2022-09-07 03:15 PM
24
5
cve
cve

CVE-2014-8597

A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin...

6.1CVSS

5.9AI Score

0.001EPSS

2022-02-17 08:15 PM
41
cve
cve

CVE-2020-23754

Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls...

9.6CVSS

8.5AI Score

0.004EPSS

2021-11-02 06:15 PM
13
cve
cve

CVE-2021-40189

PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary...

7.2CVSS

7.5AI Score

0.002EPSS

2021-10-11 07:15 PM
23
cve
cve

CVE-2021-40188

PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the...

7.2CVSS

7.2AI Score

0.001EPSS

2021-10-11 07:15 PM
21
cve
cve

CVE-2021-40541

PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of...

6.1CVSS

5.7AI Score

0.001EPSS

2021-10-11 02:15 PM
22
cve
cve

CVE-2020-23702

Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in...

4.8CVSS

5AI Score

0.001EPSS

2021-07-07 07:15 PM
25
cve
cve

CVE-2020-23184

A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration"...

5.4CVSS

5.2AI Score

0.001EPSS

2021-07-02 06:15 PM
28
2
cve
cve

CVE-2020-23181

A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme"...

5.4CVSS

5.3AI Score

0.001EPSS

2021-07-02 06:15 PM
30
2
cve
cve

CVE-2020-23185

A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted...

5.4CVSS

5.2AI Score

0.001EPSS

2021-07-02 06:15 PM
31
2
cve
cve

CVE-2020-23178

An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim...

5.4CVSS

6.3AI Score

0.001EPSS

2021-07-02 06:15 PM
28
2
cve
cve

CVE-2020-23179

A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer"...

5.4CVSS

5.9AI Score

0.001EPSS

2021-07-02 06:15 PM
32
2
cve
cve

CVE-2020-23182

The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message...

5.4CVSS

5.2AI Score

0.001EPSS

2021-07-02 06:15 PM
33
2
cve
cve

CVE-2021-28280

CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or...

6.1CVSS

6AI Score

0.001EPSS

2021-04-29 03:15 PM
37
5
cve
cve

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in...

4.3CVSS

4.7AI Score

0.001EPSS

2021-01-13 05:15 PM
57
In Wild
4
cve
cve

CVE-2020-35952

login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow...

6.5CVSS

6.5AI Score

0.001EPSS

2021-01-03 04:15 AM
25
1
cve
cve

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution...

8.8CVSS

8.7AI Score

0.939EPSS

2020-09-03 02:15 PM
93
2
cve
cve

CVE-2020-23658

PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via...

5.4CVSS

5.3AI Score

0.001EPSS

2020-08-26 06:15 PM
19
cve
cve

CVE-2020-17449

PHP-Fusion 9.03 allows XSS via the error_log...

5.4CVSS

5.4AI Score

0.001EPSS

2020-08-12 10:15 PM
14
cve
cve

CVE-2020-17450

PHP-Fusion 9.03 allows XSS on the preview...

6.1CVSS

5.9AI Score

0.001EPSS

2020-08-12 10:15 PM
14
cve
cve

CVE-2020-15041

PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link...

4.8CVSS

5.7AI Score

0.001EPSS

2020-06-24 09:15 PM
27
cve
cve

CVE-2020-14960

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype...

7.2CVSS

7.8AI Score

0.104EPSS

2020-06-22 12:15 AM
31
cve
cve

CVE-2020-12718

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as...

5.4CVSS

5.8AI Score

0.001EPSS

2020-05-08 12:15 AM
72
cve
cve

CVE-2020-12706

Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or...

5.4CVSS

5.9AI Score

0.005EPSS

2020-05-07 08:15 PM
69
cve
cve

CVE-2020-12708

Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap...

6.1CVSS

6.5AI Score

0.002EPSS

2020-05-07 08:15 PM
48
cve
cve

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php members search page. This parameter allows for control over anything after the.....

8.8CVSS

9AI Score

0.004EPSS

2020-04-29 05:15 PM
21
cve
cve

CVE-2020-12438

An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT...

5.4CVSS

5.5AI Score

0.001EPSS

2020-04-28 09:15 PM
37
cve
cve

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has...

8.8CVSS

8.7AI Score

0.001EPSS

2019-09-10 12:15 PM
30
cve
cve

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored...

6.1CVSS

6.3AI Score

0.001EPSS

2019-09-10 12:15 PM
31
cve
cve

CVE-2019-12099

In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar...

8.8CVSS

8.7AI Score

0.071EPSS

2019-05-14 09:29 PM
27
cve
cve

CVE-2015-8375

Cross-site scripting (XSS) vulnerability in PHP-Fusion...

5.4CVSS

5.3AI Score

0.001EPSS

2017-09-25 09:29 PM
17
cve
cve

CVE-2014-8596

Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to...

8.2AI Score

0.002EPSS

2014-11-17 04:59 PM
26
cve
cve

CVE-2014-7483

The Desire2Learn FUSION 2014 (aka com.desire2learn.fusion2012) application 4.0.729.1748 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

6AI Score

0.0005EPSS

2014-10-19 10:55 AM
19
cve
cve

CVE-2013-7375

SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than...

8.4AI Score

0.005EPSS

2014-05-05 05:06 PM
35
cve
cve

CVE-2013-1803

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting...

8.2AI Score

0.005EPSS

2014-05-05 05:06 PM
31
cve
cve

CVE-2013-1807

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in...

6.3AI Score

0.009EPSS

2014-04-30 11:58 PM
21
cve
cve

CVE-2013-1806

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable.....

7.1AI Score

0.012EPSS

2014-04-30 11:58 PM
22
cve
cve

CVE-2013-1804

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via.....

5.5AI Score

0.001EPSS

2014-04-29 08:55 PM
30
Total number of security vulnerabilities98