SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view_game_list action.
Max CVSS
7.5
EPSS Score
0.41%
Published
2007-04-12
Updated
2017-10-11
SQL injection vulnerability in show_event.php in the Expanded Calendar (calendar_panel) 2.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the m_month parameter.
Max CVSS
7.5
EPSS Score
1.18%
Published
2007-04-03
Updated
2018-10-16
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Max CVSS
2.6
EPSS Score
1.01%
Published
2006-09-11
Updated
2017-07-20
Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
Max CVSS
5.8
EPSS Score
0.43%
Published
2006-07-13
Updated
2018-10-18
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.
Max CVSS
6.4
EPSS Score
4.17%
Published
2006-05-19
Updated
2018-10-18
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.
Max CVSS
6.4
EPSS Score
0.63%
Published
2006-05-12
Updated
2018-10-18
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
Max CVSS
6.4
EPSS Score
0.48%
Published
2006-05-12
Updated
2018-10-18
Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.
Max CVSS
4.3
EPSS Score
0.61%
Published
2006-02-08
Updated
2017-07-20
Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
Max CVSS
4.3
EPSS Score
0.36%
Published
2005-12-31
Updated
2011-03-08
SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.
Max CVSS
7.5
EPSS Score
5.93%
Published
2005-12-28
Updated
2018-10-19
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
Max CVSS
4.3
EPSS Score
0.99%
Published
2005-12-28
Updated
2018-10-19
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php.
Max CVSS
7.5
EPSS Score
3.20%
Published
2005-12-05
Updated
2011-03-08
Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php.
Max CVSS
7.5
EPSS Score
0.90%
Published
2005-11-22
Updated
2011-03-08
Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php.
Max CVSS
7.5
EPSS Score
0.73%
Published
2005-10-06
Updated
2017-07-11
Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters.
Max CVSS
7.5
EPSS Score
0.15%
Published
2005-10-06
Updated
2008-09-05
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159.
Max CVSS
7.5
EPSS Score
0.19%
Published
2005-10-06
Updated
2016-10-18
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
Max CVSS
7.5
EPSS Score
0.26%
Published
2005-10-06
Updated
2016-10-18
Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
Max CVSS
4.3
EPSS Score
0.27%
Published
2005-09-02
Updated
2017-07-11
PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag.
Max CVSS
5.0
EPSS Score
0.70%
Published
2005-07-27
Updated
2008-09-05
PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0.
Max CVSS
5.0
EPSS Score
1.98%
Published
2005-06-29
Updated
2011-03-08
Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post, possibly involving the (1) news_body, (2) article_description, or (3) article_body parameters to submit.php.
Max CVSS
4.3
EPSS Score
0.35%
Published
2005-06-29
Updated
2011-03-08
Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the (1) user_name or (2) user_pass parameters.
Max CVSS
4.3
EPSS Score
0.22%
Published
2005-05-02
Updated
2016-10-18
Cross-site scripting (XSS) vulnerability in fusion_core.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript.
Max CVSS
4.3
EPSS Score
0.26%
Published
2005-03-06
Updated
2016-10-18
viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter.
Max CVSS
5.0
EPSS Score
2.72%
Published
2005-05-02
Updated
2017-07-11
Cross-site scripting (XSS) vulnerability in PHP-Fusion 4.01 allows remote attackers to inject arbitrary web script or HTML via the (1) Submit News, (2) Submit Link or (3) Submit Article field.
Max CVSS
4.3
EPSS Score
0.29%
Published
2004-12-31
Updated
2017-07-11
28 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!