Vulnerabilities > PHP Fusion > PHP Fusion > 9.03.50
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-02 | CVE-2020-23178 | Authentication Bypass by Capture-replay vulnerability in PHP-Fusion 9.03.50 An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user. | 5.5 |
| 2021-07-02 | CVE-2020-23179 | Cross-site Scripting vulnerability in PHP-Fusion 9.03.50 A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field. | 3.5 |
| 2021-01-03 | CVE-2020-35952 | Unspecified vulnerability in PHP-Fusion login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration. | 4.0 |
| 2020-09-03 | CVE-2020-24949 | Improper Privilege Management vulnerability in PHP-Fusion 9.03.50 Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). | 9.0 |
| 2020-06-22 | CVE-2020-14960 | SQL Injection vulnerability in PHP-Fusion 9.03.50 A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, | 6.5 |
| 2020-05-08 | CVE-2020-12718 | Cross-site Scripting vulnerability in PHP-Fusion 9.03.50 In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. | 3.5 |
| 2020-05-07 | CVE-2020-12708 | Cross-site Scripting vulnerability in PHP-Fusion 9.03.50 Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. | 4.3 |
| 2020-05-07 | CVE-2020-12706 | Cross-site Scripting vulnerability in PHP-Fusion 9.03.50 Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | 3.5 |
| 2020-04-29 | CVE-2020-12461 | SQL Injection vulnerability in PHP-Fusion 9.03.50 PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. | 6.5 |
| 2020-04-28 | CVE-2020-12438 | Cross-site Scripting vulnerability in PHP-Fusion 9.03.50 An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. | 3.5 |