Vulnerabilities > PHP Fusion

DATE CVE VULNERABILITY TITLE RISK
2004-12-31 CVE-2004-2438 SQL and HTML Injection vulnerability in PHP Fusion PHP Fusion 4.01
Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field.
network
php-fusion
4.3
2004-12-31 CVE-2004-2437 SQL and HTML Injection vulnerability in PHP Fusion PHP Fusion 4.01
SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to (1) index.php or (2) members.php, or (3) the comment_id parameter to comments.php.
network
low complexity
php-fusion
7.5
2004-12-31 CVE-2004-1723 Information Disclosure vulnerability in PHP Fusion PHP Fusion 4.00
The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message.
network
low complexity
php-fusion
5.0
2004-08-18 CVE-2004-1724 Information Disclosure vulnerability in PHP Fusion PHP Fusion 4.0
The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password.
network
low complexity
php-fusion
7.5