CVE-2020-37152
PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 5, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 3, 2026
Description
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
Affected Products
| Product | Versions |
|---|---|
PHP-FusionPHP-Fusion |
|
References
- Vendor Homepageproduct
- ExploitDB-48299exploit
- VulnCheck Advisory: PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.