Php-fusion vulnerabilities
Published CVEs affecting Php-fusion products: 4 record(s), with severity, exploitation and fixes.
CVE-2020-37152
Medium · 6.1
CWE-79 Feb 5, 2026
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
CVE-2020-37137
Critical · 9.8
CWE-94 Feb 5, 2026
PHP-Fusion 9.03.50 Remote Code Execution via Code Injection in panels.php
PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code.
CVE-2020-36996
Medium · 6.4
CWE-79 Jan 30, 2026
PHPFusion 9.03.50 - Persistent Cross-Site Scripting
PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content. Attackers can inject malicious JavaScript through forum messages that will execute when the print page is generated, allowing script execution in victim browsers.
CVE-2023-53928
Medium · 6.1
CWE-79 Dec 17, 2025
PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload SVG files with script tags that execute arbitrary JavaScript when viewed, potentially stealing user session information or performing client-side attacks.