Cross-site Scripting Vulnerabilities in PHP-Fusion by PHP-Fusion
CVE-2020-12706

5.4MEDIUM

Key Information:

Vendor

PHP-fusion

Status
PHP-fusion
Vendor
CVE Published:
7 May 2020

What is CVE-2020-12706?

Multiple cross-site scripting vulnerabilities in PHP-Fusion version 9.03.50 allow remote attackers to exploit the application by injecting arbitrary web scripts or HTML code. This occurs via the 'go' parameter within the 'faq/faq_admin.php' and 'shoutbox_panel/shoutbox_admin.php' files, posing a significant risk to the integrity of user data and application security.

References

https://github.com/php-fusion/PHP-Fusion/issues/2306
x_refsource_MISC
https://github.com/php-fusion/PHP-Fusion/commit/67273e546...
x_refsource_MISC
https://www.exploit-db.com/exploits/48404
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.