GCVE - cpe:2.3:a:php_fusion:php_fusion:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:php_fusion:php_fusion:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Php Fusion (`b98588ff-03e9-5cd6-aed1-a10b441261bd`)
Product	Php Fusion (`7cbdcda6-d222-52b5-a525-e99b85bfe051`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/phpfusion/phpfusion`	purl2cpe	2026-06-01 10:11:42.447751

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-37137`	vulnerable	2026-06-08 05:25:50.227211	PHP-Fusion 9.03.50 - 'panels.php' Eval Injection MEDIUM (6.1) PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code. Published: 2026-02-05T16:13:37.832Z Updated: 2026-07-15T01:24:27.809Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48278 https://www.php-fusion.co.uk https://www.vulncheck.com/advisories/php-fusion-panelsphp-eval-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-4673`	vulnerable	2026-06-08 04:49:18.501835	Details available Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php. Published: 2006-09-11T16:00:00.000Z Updated: 2024-08-07T19:23:40.437Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/19908 http://marc.info/?l=bugtraq&m=115765187519458&w=2 http://www.vupen.com/english/advisories/2006/3523 http://www.php-fusion.co.uk/news.php?readmore=353 http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3740`	vulnerable	2026-06-08 04:48:41.949616	Details available Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php. Published: 2005-11-22T11:00:00.000Z Updated: 2024-08-07T23:24:36.279Z Open on db.gcve.eu Reference links http://www.osvdb.org/20992 http://seclists.org/lists/bugtraq/2005/Nov/0237.html http://myblog.it-security23.net/advisories/advisory-6.txt http://seclists.org/lists/bugtraq/2005/Nov/0232.html http://www.securityfocus.com/bid/15502	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3739`	not_vulnerable	2026-06-08 04:48:41.949133	Details available Unspecified vulnerability in subheader.php in PHP-Fusion 6.00.206 and earlier allows remote attackers to obtain the full path via unspecified vectors. Published: 2005-11-22T11:00:00.000Z Updated: 2024-08-07T23:24:36.149Z Open on db.gcve.eu Reference links http://seclists.org/lists/bugtraq/2005/Nov/0237.html http://myblog.it-security23.net/advisories/advisory-6.txt http://www.osvdb.org/20990 http://seclists.org/lists/bugtraq/2005/Nov/0232.html http://www.vupen.com/english/advisories/2005/2504	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.