Php-fusion vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2020-37137 PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an High 8.6 · Feb 5, 2026
• CVE-2021-3172 An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.High 8.1 · Feb 17, 2023
• CVE-2020-23754 Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via thCritical 9.6 · Nov 2, 2021
• CVE-2021-40189 PHPFusion 9.03.110 is affected by a remote code execution vulnerability.High 7.2 · Oct 11, 2021
• CVE-2021-40188 PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability.High 7.2 · Oct 11, 2021
• CVE-2020-24949 Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform High 8.8 · Sep 3, 2020
• CVE-2020-14960 A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,High 7.2 · Jun 21, 2020
• CVE-2020-12461 PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism.High 8.8 · Apr 29, 2020
• CVE-2019-12099 In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and inHigh 8.8 · May 14, 2019
• CVE-2014-8596 Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter High 7.5 · Nov 17, 2014
• CVE-2013-7375 SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL coHigh 7.5 · May 5, 2014
• CVE-2013-1803 Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to doHigh 7.5 · May 5, 2014
• CVE-2010-4931 Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a ..High 10 · Oct 9, 2011
• CVE-2008-5946 SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.High 7.5 · Jan 22, 2009
• CVE-2008-5733 SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the iHigh 7.5 · Dec 26, 2008
• CVE-2008-5197 SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_advertsHigh 7.5 · Nov 21, 2008
• CVE-2008-5196 SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commanHigh 7.5 · Nov 21, 2008
• CVE-2008-5074 SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkiHigh 7.5 · Nov 14, 2008
• CVE-2008-4527 SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the kHigh 7.5 · Oct 9, 2008
• CVE-2008-4521 SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtracker_panel) module 2.0 for PHP-Fusion allows remote attackHigh 7.5 · Oct 9, 2008
• CVE-2007-5187 SQL injection vulnerability in infusions/calendar_events_panel/show_single.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to exeHigh 7.5 · Oct 3, 2007
• CVE-2007-1978 SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameteHigh 7.5 · Apr 11, 2007
• CVE-2007-1845 SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary High 7.5 · Apr 3, 2007
• CVE-2005-4517 SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiHigh 7.5 · Dec 27, 2005
• CVE-2005-4005 SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commandHigh 7.5 · Dec 4, 2005