PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'addpanelform()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panelcontent POST parameters to the panels.php administration endpoint to execute malicious code.

PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of text.

PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code.

PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server.

SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.

SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magicquotesgpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.

SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

SQL injection vulnerability in blog.php in the Team Impact TI Blog System mod for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the id parameter.

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/dbbackups/.

Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) userlist or (3) usertypes parameter to messages.php; (4) message parameter to infusions/shoutboxpanel/shoutboxadmin.php; (5) message parameter to administration/news.php; (6) panellist parameter to administration/paneleditor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "BBCODE" parameter to administration/bbcodes.php; errorMessage parameter to (9) articlecats.php, (10) downloadcats.php, (11) newscats.php, or (12) weblinkcats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.

Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) usertheme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/userfields.php or (3) file parameter to administration/dbbackup.php.

SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803.

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "deleteattach" in an edit action to forum/postedit.php; the (3) pollopts[] parameter in a newthread action to forum/postnewthread.php; the (4) pmemailnotify, (5) pmsavesent, (6) pminbox, (7) pmsentbox, or (8) pmsavebox parameter to administration/settingsmessages.php; the (9) thumbcompression, (10) photowatermarktextcolor1, (11) photowatermarktextcolor2, or (12) photowatermarktextcolor3 parameter to administration/settingsphoto.php; the (13) enable parameter to administration/bbcodes.php; the (14) newsimage, (15) newsimaget1, or (16) newsimaget2 parameter to administration/news.php; the (17) newsid parameter in an edit action to administration/news.php; or the (18) articleid parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.

SQL injection vulnerability in books.php in the Book Panel (bookpanel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the bookid parameter.

PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload SVG files with script tags that execute arbitrary JavaScript when viewed, potentially stealing user session information or performing client-side attacks.

PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panelcontent' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panelcontent' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.

An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write files to arbitrary locations, provided the files pass the application’s mime-type and file extension validation.

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.

SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the viewid parameter.

DISPUTED Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party.

SQL injection vulnerability in infusions/calendareventspanel/showsingle.php in the Expanded Calendar 2.x module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the sel parameter.

Cross-site scripting (XSS) vulnerability in infusions/shoutboxpanel/shoutboxpanel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSIONQUERY constant.

Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msgsend parameters, a different vector than CVE-2005-3157, CVE-2005-3158, CVE-2005-3159, CVE-2005-4005, and CVE-2006-2459.

SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter.

SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detailadverts action.

SQL injection vulnerability in kroax.php in the Kroax (thekroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the category parameter.

SQL injection vulnerability in thisraidprogress.php in the World of Warcraft tracker infusion (raidtrackerpanel) module 2.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the INFORAIDID parameter.

SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the katid parameter in a kategorier action. NOTE: some of these details are obtained from third party information.