RSS   Vulnerabilities for 'Php-fusion'   RSS

2021-07-07
 
CVE-2020-23702

CWE-79
 
 
Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.

 
2021-07-02
 
CVE-2020-23178

CWE-294
 
 
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.

 
 
CVE-2020-23179

CWE-79
 
 
A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field.

 
 
CVE-2020-23181

CWE-79
 
 
A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.

 
 
CVE-2020-23182

CWE-601
 
 
The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.

 
 
CVE-2020-23184

CWE-79
 
 
A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.

 
 
CVE-2020-23185

CWE-79
 
 
A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

 
2020-09-03
 
CVE-2020-24949

CWE-269
 
 
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).

 
2020-08-26
 
CVE-2020-23658

CWE-79
 
 
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.

 
2020-08-12
 
CVE-2020-17450

CWE-79
 
 
PHP-Fusion 9.03 allows XSS on the preview page.

 

Copyright 2024, cxsecurity.com

 

Back to Top