Php-Fusion

Every one of the 66 is a mark on the map. Named now: 1 to 26, most at risk first.

1. PHP-Fusion 9.03.50 - Remote Code ExecutionCVE-2020-24949Php-Fusion · 67% likely
2. In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPF…CVE-2019-12099Php-Fusion · 17% likely

   CWE-434

3. Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level paramet…CVE-2010-4931Php-Fusion · 16% likely

   CWE-22

4. PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that…CVE-2006-2330Php Fusion · 8.0% likely
5. Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) use…CVE-2013-1806Php-Fusion · 7.8% likely

   CWE-22

6. PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sen…CVE-2013-1807Php-Fusion · 7.6% likely

   CWE-264

7. The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote…CVE-2004-1724Php Fusion · 6.9% likely
8. PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain s…CVE-2005-2075Php Fusion · 6.8% likely
9. Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[loca…CVE-2006-2331Php Fusion · 4.5% likely
10. Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to f…CVE-2013-1804Php-Fusion · 4.4% likely

    CWE-79

11. SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_adverts action.CVE-2008-5197Php-Fusion · 4.1% likely

    CWE-89

12. Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or rem…CVE-2013-1803Php-Fusion · 3.9% likely

    CWE-89

13. SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability…CVE-2005-3157Php Fusion · 3.6% likely
14. SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user…CVE-2013-7375Php-Fusion · 3.5% likely

    CWE-89

15. Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to fi…CVE-2014-8596Php-Fusion · 3.3% likely

    CWE-89

16. Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shou…CVE-2020-12706Php-Fusion · 2.9% likely

    CWE-79

17. SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the…CVE-2008-5335Php-Fusion · 2.9% likely

    CWE-89

18. viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attackers to view protected forums via the thread_id parameter.CVE-2005-0345Php Fusion · 2.8% likely
19. SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.CVE-2006-2459Php Fusion · 2.1% likely
20. Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_pane…CVE-2006-0593Php Fusion · 2.1% likely
21. Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parame…CVE-2005-4516Php Fusion · 2.1% likely
22. SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_sa…CVE-2005-3158Php Fusion · 1.8% likely
23. Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.CVE-2005-2783Php Fusion · 1.8% likely
24. A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,CVE-2020-14960Php-Fusion · 1.7% likely

    CWE-89

25. PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sort…CVE-2020-12461Php-Fusion · 1.7% likely

    CWE-89

26. Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HTML via the (1) user_…CVE-2005-0829Php Fusion · 1.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.