Skip to content
Noroxi

PHP-Fusion records

62 published records for vendor php-fusion.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
20
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

62 records
  • CVE-2020-24949
    55Plan

    Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the

    HighCVSS 8.8Proof of conceptEPSS 68%

    php-fusion · php-fusionSep 3, 2020

  • CVE-2010-4931
    45Plan

    Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    php-fusion · php-fusionOct 9, 2011

  • CVE-2019-12099
    40Plan

    In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_

    HighCVSS 8.8Proof of conceptEPSS 17%

    php-fusion · php-fusionMay 14, 2019

  • CVE-2020-23754
    38Monitor

    Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute ar

    CriticalCVSS 9.6No exploitEPSS 2%

    php-fusion · phpfusionNov 2, 2021

  • CVE-2020-12461
    36Monitor

    PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism.

    HighCVSS 8.8No exploitEPSS 2%

    php-fusion · php-fusionApr 29, 2020

  • CVE-2023-2453
    35Monitor

    Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

    HighCVSS 8.8No exploitEPSS 1%

    php-fusion · phpfusionSep 5, 2023

  • CVE-2022-3152
    35Monitor

    Unverified Password Change in phpfusion/phpfusion

    HighCVSS 8.8No exploitEPSS 1%

    php-fusion · phpfusionSep 7, 2022

  • CVE-2020-37137
    34Monitor

    PHP-Fusion 9.03.50 - 'panels.php' Eval Injection

    HighCVSS 8.6No exploitEPSS 1%

    php-fusion · phpfusionFeb 5, 2026

  • CVE-2021-3172
    32Monitor

    An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling fe

    HighCVSS 8.1No exploitEPSS 1%

    php-fusion · php-fusionFeb 17, 2023

  • CVE-2007-5187
    31Monitor

    SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows rem

    HighCVSS 7.5Proof of conceptEPSS 4%

    php-fusion · expanded calendar moduleOct 3, 2007

  • CVE-2008-5197
    31Monitor

    SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter

    HighCVSS 7.5Proof of conceptEPSS 4%

    php-fusion · php-fusionNov 21, 2008

  • CVE-2013-1803
    31Monitor

    Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) ord

    HighCVSS 7.5Proof of conceptEPSS 4%

    php-fusion · php-fusionMay 5, 2014

  • CVE-2013-7375
    31Monitor

    SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to exec

    HighCVSS 7.5Proof of conceptEPSS 4%

    php-fusion · php-fusionMay 5, 2014

  • CVE-2014-8596
    31Monitor

    Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1)

    HighCVSS 7.5Proof of conceptEPSS 3%

    php-fusion · php-fusionNov 17, 2014

  • CVE-2010-4791
    30Monitor

    SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) mo

    HighCVSS 7.5Proof of conceptEPSS 1%

    marcusg · mg user fotoalbum panelApr 26, 2011

  • CVE-2009-0832
    30Monitor

    SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands v

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · php-fusionMar 5, 2009

  • CVE-2008-4527
    30Monitor

    SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQ

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · recepies moduleOct 9, 2008

  • CVE-2008-5733
    30Monitor

    SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQ

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · team impact ti blog system moduleDec 26, 2008

  • CVE-2009-3119
    30Monitor

    SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitr

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · php-fusionSep 9, 2009

  • CVE-2008-5074
    30Monitor

    SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL co

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · freshlinks moduleNov 14, 2008

  • CVE-2008-4521
    30Monitor

    SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · world of warcraft tracker infusion moduleOct 9, 2008

  • CVE-2008-5196
    30Monitor

    SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · php-fusionNov 21, 2008

  • CVE-2008-5946
    30Monitor

    SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id par

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · php-fusionJan 22, 2009

  • CVE-2009-4889
    30Monitor

    SQL injection vulnerability in books.php in the Book Panel (book_panel) module for PHP-Fusion allows remote attackers to execute arbitrary S

    HighCVSS 7.5Proof of conceptEPSS 1%

    php-fusion · php-fusionJun 11, 2010

  • CVE-2021-40189
    29Monitor

    PHPFusion 9.03.110 is affected by a remote code execution vulnerability.

    HighCVSS 7.2No exploitEPSS 2%

    php-fusion · phpfusionOct 11, 2021