PHP-Fusion 9.03.50
Approved changes feed: RSS · Atom
cpe:2.3:a:php-fusion:php-fusion:9.03.50:*:*:*:*:*:*:*
part: a version: 9.03.50 update: *
| Vendor | Php Fusion (9882a299-fb6b-5a33-aa4e-52dbde0ad700) |
|---|---|
| Product | Php Fusion (c30bafad-3859-5c09-a722-eecfce5287ee) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/phpfusion/phpfusion |
purl2cpe | 2026-06-01 10:15:01.254385 |
pkg:sourceforge/product/php-fusion |
purl2cpe | 2026-06-01 10:15:01.254386 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-24949 |
vulnerable | 2026-06-08 05:22:35.741862 |
Details available
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).
Published: 2020-09-03T13:51:12.000Z
Updated: 2024-08-04T15:26:08.691Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-23179 |
vulnerable | 2026-06-08 05:22:31.805141 |
Details available
A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field.
Published: 2021-07-02T17:51:07.000Z
Updated: 2024-08-04T14:58:14.495Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-23178 |
vulnerable | 2026-06-08 05:22:31.804549 |
Details available
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.
Published: 2021-07-02T17:51:05.000Z
Updated: 2024-08-04T14:58:14.437Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14960 |
vulnerable | 2026-06-08 05:19:25.037923 |
Details available
A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,
Published: 2020-06-21T23:04:40.000Z
Updated: 2024-08-04T13:00:52.019Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12718 |
vulnerable | 2026-06-08 05:17:58.931506 |
Details available
In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.
Published: 2020-05-07T23:29:26.000Z
Updated: 2024-08-04T12:04:22.777Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12708 |
vulnerable | 2026-06-08 05:17:58.920912 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12706 |
vulnerable | 2026-06-08 05:17:58.918759 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12461 |
vulnerable | 2026-06-08 05:17:58.209312 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12438 |
vulnerable | 2026-06-08 05:17:58.187332 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.