CVE-2020-12438
lowpriority · track · 22EPSS 0.006 · 48 %ileEUUSEPSS · scored 2026-10-27
An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–5.4
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8cnnvd
- https://github.com/php-fusion/PHP-Fusion/issues/2307cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-12438cnnvd
- https://www.phpfusion.com/phpfusion_9_downloads.phpPatchcnnvd
- https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8enisa_euvd
- https://github.com/php-fusion/PHP-Fusion/issues/2307enisa_euvd
- https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8PatchThird Party Advisorynvd
- https://github.com/php-fusion/PHP-Fusion/issues/2307ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan