CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2005-2074
https://notcve.org/view.php?id=CVE-2005-2074
29 Jun 2005 — Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post, possibly involving the (1) news_body, (2) article_description, or (3) article_body parameters to submit.php. • http://dark-assassins.com/forum/viewtopic.php?t=145 •
CVSS: 7.5EPSS: 3%CPEs: 2EXPL: 2CVE-2005-2075 – PHP-Fusion 6.00.105 - Accessible Database Backups Download
https://notcve.org/view.php?id=CVE-2005-2075
29 Jun 2005 — PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0. • https://www.exploit-db.com/exploits/1068 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2005-0829 – PHP-Fusion 4/5 - 'Setuser.php' HTML Injection
https://notcve.org/view.php?id=CVE-2005-0829
22 Mar 2005 — Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the (1) user_name or (2) user_pass parameters. • https://www.exploit-db.com/exploits/25241 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2005-0692
https://notcve.org/view.php?id=CVE-2005-0692
06 Mar 2005 — Cross-site scripting (XSS) vulnerability in fusion_core.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript. • http://marc.info/?l=bugtraq&m=111022851900028&w=2 •
CVSS: 5.3EPSS: 4%CPEs: 1EXPL: 1CVE-2005-0345 – PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
https://notcve.org/view.php?id=CVE-2005-0345
10 Feb 2005 — viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter. • https://www.exploit-db.com/exploits/25089 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2004-1723
https://notcve.org/view.php?id=CVE-2004-1723
31 Dec 2004 — The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message. • http://marc.info/?l=bugtraq&m=109285292901685&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2004-2437
https://notcve.org/view.php?id=CVE-2004-2437
31 Dec 2004 — SQL injection vulnerability in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the rowstart parameter to (1) index.php or (2) members.php, or (3) the comment_id parameter to comments.php. • http://secunia.com/advisories/12686 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2004-2438
https://notcve.org/view.php?id=CVE-2004-2438
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field. • http://secunia.com/advisories/12686 •
CVSS: 9.1EPSS: 3%CPEs: 1EXPL: 2CVE-2004-1724 – PHP-Fusion Database Backup - Information Disclosure
https://notcve.org/view.php?id=CVE-2004-1724
18 Aug 2004 — The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password. • https://www.exploit-db.com/exploits/24384 •