Vulnerabilidades do Php-fusion Phpfusion
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Php-fusion Phpfusion: 4 registro(s), com versões afetadas e correções.cpe:2.3:a:php-fusion:phpfusion
CVE-2020-37152
Média · 6.1
CWE-79 05/02/2026
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
CVE-2020-37137
Crítica · 9.8
CWE-94 05/02/2026
PHP-Fusion 9.03.50: execução remota de código por injeção de código em panels.php
O PHP-Fusion 9.03.50 contém uma vulnerabilidade de execução remota de código na função 'add_panel_form()', que permite que atacantes executem código arbitrário por meio de uma função eval() com dados POST não sanitizados. Atacantes podem explorar a vulnerabilidade enviando parâmetros POST panel_content elaborados para o endpoint administrativo panels.php para executar código malicioso.
CVE-2020-36996
Média · 6.4
CWE-79 30/01/2026
PHPFusion 9.03.50 - Persistent Cross-Site Scripting
PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content. Attackers can inject malicious JavaScript through forum messages that will execute when the print page is generated, allowing script execution in victim browsers.
CVE-2023-53928
Média · 6.1
CWE-79 17/12/2025
PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload SVG files with script tags that execute arbitrary JavaScript when viewed, potentially stealing user session information or performing client-side attacks.