Php-fusion
41 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Php-fusion, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Php-fusion CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 41 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High12
- Medium27
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Php-fusion.
- CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)6.1
- CVE-2023-4480Arbitrary File Read in Fusion File Manager5.5
- CVE-2023-2453Local file Inclusion (LFI) in Forum Infusion via Directory Traversal8.8
- CVE-2021-3172An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.8.1
- BDU:2022-05044Уязвимость CMS-системы PHP-Fusion, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)6.8
- BDU:2022-05045Уязвимость CMS-системы PHP-Fusion, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)7.4
- CVE-2020-23702Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.4.8
- CVE-2020-23185A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted...5.4
- CVE-2020-23184A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a cr...5.4
- CVE-2020-23182The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the ...5.4
- CVE-2020-23181A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload...5.4
- CVE-2020-23179A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay...5.4
- CVE-2020-23178An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.5.4
- CVE-2020-35952login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect us...6.5
- CVE-2020-24949Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).8.8
Product grouping is registry-driven, with AI assist and human review. How it works