CVE-2020-35687

low-risk

Published 2021-01-13

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

49426

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Phpfusion

Affected Vendors

Php-Fusion

References (4)

Exploit https://github.com/PHPFusion/PHPFusion/issues/2347

Exploit https://www.exploit-db.com/exploits/49426

Exploit https://github.com/PHPFusion/PHPFusion/issues/2347

Exploit https://www.exploit-db.com/exploits/49426

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal