CVE-2020-23184: XSS
A stored cross site scripting (XSS) vulnerability in /administration/settingsregistration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-23184?
CVE-2020-23184 is a stored cross site scripting (XSS) vulnerability in PHP-Fusion 9.03.60.
How does the vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 occur?
The vulnerability occurs when authenticated attackers enter a crafted payload into the "Registration" field, allowing them to execute arbitrary web scripts or HTML.
What is the severity of CVE-2020-23184?
CVE-2020-23184 has a severity rating of medium (5.4).
How can I fix the stored cross site scripting (XSS) vulnerability in PHP-Fusion 9.03.60?
To fix the vulnerability, update PHP-Fusion to a version that is not affected by the XSS vulnerability.
Where can I find more information about CVE-2020-23184?
More information about CVE-2020-23184 can be found at the following reference: https://github.com/phpfusion/PHPFusion/issues/2323