CVE-2022-3152

CVE-2022-3152 affects phpfusion/phpfusion prior to 9.10.20. The issue is described as an unverified password change, enabling account takeover. Connected documents corroborate the vulnerability class as improper/authentication weakness and consistently point to versions before 9.10.20. The remedi...

CVE-2020-23754

PHP-Fusion 9.03.50 contains a Cross-Site Scripting vulnerability in infusions/member_poll_panel/poll_admin.php that allows an attacker to execute arbitrary code via the polls feature. Sources attribute the root cause to insufficient filtering/escaping of user-submitted input. This affects PHP-Fus...

CVE-2020-37137

CVE-2020-37137 affects PHP-Fusion 9.03.50. The remote code execution vulnerability resides in the add_panel_form() path where eval() processes unsanitized POST data (panel_content) sent to panels.php, enabling arbitrary code execution. Exploitation details and PoCs are referenced in the connected...