CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35952
https://notcve.org/view.php?id=CVE-2020-35952
03 Jan 2021 — login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration. El archivo login.php en PHPFusion (también se conoce como PHP-Fusion) Andromeda versión 9.x antes del 30-12-2020 genera mensajes de error que distinguen entre un nombre de usuario incorrecto y una contraseña incorrecta (es decir, ni un solo... • https://github.com/PHPFusion/PHPFusion/issues/2346 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17450
https://notcve.org/view.php?id=CVE-2020-17450
12 Aug 2020 — PHP-Fusion 9.03 allows XSS on the preview page. PHP-Fusion versión 9.03, permite un ataque de tipo XSS en la página de vista previa • https://sec-consult.com/en/blog/advisories/multiple-cross-site-scripting-xss-vulnerabilities-in-php-fusion-cms • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17449
https://notcve.org/view.php?id=CVE-2020-17449
12 Aug 2020 — PHP-Fusion 9.03 allows XSS via the error_log file. PHP-Fusion versión 9.03, permite un ataque de tipo XSS por medio del archivo error_log • https://sec-consult.com/en/blog/advisories/multiple-cross-site-scripting-xss-vulnerabilities-in-php-fusion-cms • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 42%CPEs: 1EXPL: 2CVE-2019-12099 – PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-12099
14 May 2019 — In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. En PHP-Fusion versión 9.03.00, el archivo edit_profile.php permite a los usuarios autenticados remotamente ejecutar código arbitrario porque includes/dynamics/includes/form_fileinput.php y includes/classes/PHPFusion/Installer/Lib/Core.settings.in... • https://www.exploit-db.com/exploits/46839 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2015-8375
https://notcve.org/view.php?id=CVE-2015-8375
25 Sep 2017 — Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en PHP-Fusion 9. • http://cve.killedkenny.io/cve/CVE-2015-8375 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •