Php-fusion

This hub aggregates every CVE we track for Php-fusion, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Php-fusion.

• CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)6.1Feb 5, 2026
• CVE-2023-4480Arbitrary File Read in Fusion File Manager5.5Sep 5, 2023
• CVE-2023-2453Local file Inclusion (LFI) in Forum Infusion via Directory Traversal8.8Sep 5, 2023
• CVE-2021-3172An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.8.1Feb 17, 2023
• BDU:2022-05044Уязвимость CMS-системы PHP-Fusion, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)6.8Aug 17, 2022
• BDU:2022-05045Уязвимость CMS-системы PHP-Fusion, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)7.4Aug 17, 2022
• CVE-2020-23702Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.4.8Jul 7, 2021
• CVE-2020-23185A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted...5.4Jul 2, 2021
• CVE-2020-23184A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a cr...5.4Jul 2, 2021
• CVE-2020-23182The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the ...5.4Jul 2, 2021
• CVE-2020-23181A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload...5.4Jul 2, 2021
• CVE-2020-23179A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay...5.4Jul 2, 2021
• CVE-2020-23178An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.5.4Jul 2, 2021
• CVE-2020-35952login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect us...6.5Jan 3, 2021
• CVE-2020-24949Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).8.8Sep 3, 2020