CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2004-2437
https://notcve.org/view.php?id=CVE-2004-2437
31 Dec 2004 — SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to (1) index.php or (2) members.php, or (3) the comment_id parameter to comments.php. • http://secunia.com/advisories/12686 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2004-2438
https://notcve.org/view.php?id=CVE-2004-2438
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field. • http://secunia.com/advisories/12686 •
CVSS: 9.1EPSS: 3%CPEs: 1EXPL: 2CVE-2004-1724 – PHP-Fusion Database Backup - Information Disclosure
https://notcve.org/view.php?id=CVE-2004-1724
18 Aug 2004 — The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password. • https://www.exploit-db.com/exploits/24384 •