CVSS: 5.4EPSS: 11%CPEs: 5EXPL: 1CVE-2013-1804 – PHP-Fusion 7.02.05 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1804
29 Apr 2014 — Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to adm... • https://www.exploit-db.com/exploits/24562 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2012-6043 – PHP-Fusion 7.2.4 - 'downloads.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6043
26 Nov 2012 — Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en downloads.php en PHP-Fusion v7.02.04 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro cat_id. • https://www.exploit-db.com/exploits/36541 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2008-6850
https://notcve.org/view.php?id=CVE-2008-6850
07 Jul 2009 — Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en messages.php de PHP-Fusion v6.01.17 and v7.00.3, permite a usuarios remotos inyectar código web y HTML a su elección a través de vectores no especificados. • http://osvdb.org/51053 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3CVE-2008-5946 – PHP-Fusion 4.01 - 'readmore.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-5946
22 Jan 2009 — SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter. Vulnerabilidad de inyección SQL en readmore.php en PHP-Fusion 4.01 permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro news_id. • https://www.exploit-db.com/exploits/32242 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 2CVE-2008-5335 – PHP-Fusion 7.00.1 - 'messages.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-5335
05 Dec 2008 — SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459. Vulnerabilidad de inyección SQL en messages.php en PHP-Fusion v6.01.15 y v7.00.1, cuando magic_quotes_gpc se deshabilita, permitiría a atacantes remotos ejecutar comando SQL a su elección a traves ... • https://www.exploit-db.com/exploits/7173 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 3CVE-2008-1918 – PHP-Fusion 6.01.14 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-1918
22 Apr 2008 — SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action. NOTE: it was later reported that 7.00.2 is also affected. Vulnerabilidad de inyección SQL en el archivo submit.php en PHP-Fusion versiones 6.01.14 y 6.00.307, cuando magic_quotes_gpc está deshabilitado y se conoce el prefijo de la ... • https://www.exploit-db.com/exploits/5470 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3559
https://notcve.org/view.php?id=CVE-2007-3559
04 Jul 2007 — Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSION_QUERY constant. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en infusions/shoutbox_panel/shoutbox_panel.php en PHP-Fusion 6.01.10 y 6.01.9, cuando los mensajes de invitados están habilitados, permite a atacantes remotos inyectar se... • http://osvdb.org/36342 •