CVE-2021-28280

PHPFusion 9.03.110 is affected by a CSRF and XSS vulnerability in search.php that allows remote attackers to inject arbitrary web script or HTML. This has been reported across multiple sources (NVD, Red Hat, CNVD, OSV, CNVD, OpenVAS and others) with consistent description. The CVE is not accompan...

CVE-2014-8597

CVE-2014-8597 describes a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07. The issue allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel. Documents in the connected set corroborate the vulnerability as a reflected...

CVE-2021-40541

CVE-2021-40541 affects PHPFusion 9.03.110. The vulnerability is an XSS in the descript() function, triggered when an authenticated user appends "//" at the end of text, due to how the preg filter handles HTML tags. The available sources (NVD, CNVD, CVE List) describe the issue; no exploitation de...

CVE-2020-37152

PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the panel_content POST parameter. The issue arises from insufficient sanitization of user input before rendering in the browser, enabling an attacker to inject arbitrary JavaScript that executes in the context of the af...

CVE-2023-53928

PHPFusion 9.10.30 is affected by a stored cross-site scripting vulnerability in the file manager, allowing attackers to upload SVGs with embedded JavaScript. When such SVGs are viewed, they can execute client-side code that may steal session information or perform other user-side actions. The vul...