CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40541
https://notcve.org/view.php?id=CVE-2021-40541
PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of text. PHPFusion versión 9.03.110, está afectado por una vulnerabilidad de tipo cross-site scripting (XSS) en la etiqueta html preg patterns filter sin "//" en la función descript() Un usuario autenticado puede desencadenar un ataque de tipo XSS añadiendo "//" al final del texto • https://github.com/PHPFusion/PHPFusion/issues/2373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-28280
https://notcve.org/view.php?id=CVE-2021-28280
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML CSRF + Una vulnerabilidad de Cross-site scripting (XSS) en el archivo search.php en PHPFusion versión 9.03.110, permite a atacantes remotos inyectar script web o HTML arbitrario • https://anotepad.com/notes/2skndayt https://github.com/PHPFusion/PHPFusion/commit/08d6c2ea49bd06fcce32275252f5f25abe61965c https://github.com/PHPFusion/PHPFusion/commit/1c2b32321cf11ed1cd3ff835f8da0d172c849ce6 https://github.com/PHPFusion/PHPFusion/commit/da9f89ae70219f357fba6fffd2dae1ec886d8a3b https://github.com/PHPFusion/PHPFusion/commit/fda266c3bb35c650a8c4c51b6923abdfb66ef5cd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •