Cross-Site Scripting in PHP-Fusion by PHP-Fusion Team
CVE-2020-15041

4.8MEDIUM

Key Information:

Vendor

PHP-fusion

Status
PHP-fusion
Vendor
CVE Published:
24 June 2020

What is CVE-2020-15041?

The PHP-Fusion version 9.03.60 is susceptible to a Cross-Site Scripting (XSS) vulnerability, which occurs via the 'Add Site Link' feature in the administration panel. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session information.

References

https://github.com/php-fusion/PHP-Fusion/issues/2330
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.