CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2005-2401
https://notcve.org/view.php?id=CVE-2005-2401
PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag. PHP-Fusion permite que atacantes remotos inyecten CSS arbitrario mediante el tag de color BBCode. • http://secunia.com/advisories/16096 http://www.osvdb.org/18111 http://www.securityfocus.com/bid/14332 •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 1CVE-2005-0345 – PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
https://notcve.org/view.php?id=CVE-2005-0345
viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter. • https://www.exploit-db.com/exploits/25089 http://marc.info/?l=bugtraq&m=110788267311132&w=2 http://www.securityfocus.com/bid/12482 https://exchange.xforce.ibmcloud.com/vulnerabilities/19257 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2004-1723
https://notcve.org/view.php?id=CVE-2004-1723
The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message. • http://marc.info/?l=bugtraq&m=109285292901685&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/17036 •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 2CVE-2004-1724 – PHP-Fusion Database Backup - Information Disclosure
https://notcve.org/view.php?id=CVE-2004-1724
The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password. • https://www.exploit-db.com/exploits/24384 http://marc.info/?l=bugtraq&m=109285292901685&w=2 http://secunia.com/advisories/12336 http://www.securityfocus.com/bid/10974 https://exchange.xforce.ibmcloud.com/vulnerabilities/17037 •