Php-fusion
Php-fusion: vulnerabilidades y CVE
Php-fusion tiene 38 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE38
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-3172 | Alta (8.1) | 0.65% | — | 17 feb 2023 | An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature. |
| CVE-2020-23702 | Media (4.8) | 0.60% | — | 7 jul 2021 | Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php. |
| CVE-2020-23185 | Media (5.4) | 0.45% | — | 2 jul 2021 | A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2020-23184 | Media (5.4) | 0.45% | — | 2 jul 2021 | A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered… |
| CVE-2020-23182 | Media (5.4) | 0.52% | — | 2 jul 2021 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel. |
| CVE-2020-23181 | Media (5.4) | 0.45% | — | 2 jul 2021 | A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the… |
| CVE-2020-23179 | Media (5.4) | 0.47% | — | 2 jul 2021 | A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the… |
| CVE-2020-23178 | Media (5.4) | 0.52% | — | 2 jul 2021 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user. |
| CVE-2020-35952 | Media (6.5) | 0.91% | — | 3 ene 2021 | login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password"… |
| CVE-2020-24949 | Alta (8.8) | 68% | — | 3 sept 2020 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). |
| CVE-2020-23658 | Media (5.4) | 0.49% | — | 26 ago 2020 | PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. |
| CVE-2020-17450 | Media (6.1) | 0.80% | — | 12 ago 2020 | PHP-Fusion 9.03 allows XSS on the preview page. |
| CVE-2020-17449 | Media (5.4) | 0.55% | — | 12 ago 2020 | PHP-Fusion 9.03 allows XSS via the error_log file. |
| CVE-2020-15041 | Media (4.8) | 0.54% | — | 24 jun 2020 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. |
| CVE-2020-14960 | Alta (7.2) | 1.7% | — | 22 jun 2020 | A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, |
| CVE-2020-12718 | Media (5.4) | 0.66% | — | 8 may 2020 | In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML… |
| CVE-2020-12708 | Media (6.1) | 0.92% | — | 7 may 2020 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might… |
| CVE-2020-12706 | Media (5.4) | 2.9% | — | 7 may 2020 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php |
| CVE-2020-12461 | Alta (8.8) | 1.7% | — | 29 abr 2020 | PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort_order GET parameter on the members.php… |
| CVE-2020-12438 | Media (5.4) | 0.58% | — | 28 abr 2020 | An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event… |
| CVE-2019-12099 | Alta (8.8) | 17% | — | 14 may 2019 | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc… |
| CVE-2015-8375 | Media (5.4) | 0.98% | — | 25 sept 2017 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. |
| CVE-2014-8596 | Alta (7.5) | 3.3% | — | 17 nov 2014 | Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or… |
| CVE-2013-7375 | Alta (7.5) | 3.6% | — | 5 may 2014 | SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different… |
| CVE-2013-1803 | Alta (7.5) | 4.0% | — | 5 may 2014 | Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain… |
| CVE-2013-1807 | Media (5) | 7.6% | — | 30 abr 2014 | PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request… |
| CVE-2013-1806 | Media (6.5) | 7.8% | — | 30 abr 2014 | Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or… |
| CVE-2013-1804 | Media (4.3) | 4.4% | — | 29 abr 2014 | Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote… |
| CVE-2012-6043 | Media (4.3) | 1.6% | — | 26 nov 2012 | Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter. |
| CVE-2010-4931 | Alta (10) | 16% | — | 9 oct 2011 | Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level parameter. NOTE: this issue has been disputed… |