CVE-2020-12718: XSS
In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-12718?
CVE-2020-12718 is a stored XSS vulnerability in the Preview Comment feature of PHP-Fusion 9.03.50, which can be exploited by an authenticated attacker.
How can an attacker exploit CVE-2020-12718?
An authenticated attacker can exploit CVE-2020-12718 by using HTML event handlers like ontoggle to bypass the protection mechanism in the Preview Comment feature.
What is the severity of CVE-2020-12718?
The severity of CVE-2020-12718 is medium with a CVSS score of 5.4.
How can I fix the CVE-2020-12718 vulnerability?
To fix the CVE-2020-12718 vulnerability, it is recommended to upgrade PHP-Fusion to version 9.03.51 or later.
Where can I find more information about CVE-2020-12718?
You can find more information about CVE-2020-12718 on the official GitHub page for PHP-Fusion.