How many CVEs does PHP-Fusion have?

PHP-Fusion has 93 published CVE records since 2005, including 4 in the last two years.

How many PHP-Fusion CVEs are in CISA KEV?

None of PHP-Fusion's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which PHP-Fusion products have the most CVEs?

The PHP-Fusion products with the most published CVEs are PHP-Fusion, PHP Fusion, PHPFusion, expanded calendar module, phpfusion/phpfusion.

What are the most common weakness types in PHP-Fusion CVEs?

PHP-Fusion's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), CWE-620 (Unverified Password Change), CWE-732 (Incorrect Permission Assignment for Critical Resource).

Are there public exploits for PHP-Fusion vulnerabilities?

Yes — 51 of PHP-Fusion's CVEs have a known public exploit.

How many critical PHP-Fusion vulnerabilities are there?

PHP-Fusion has 2 critical and 37 high-severity CVEs.

What is the average severity of PHP-Fusion CVEs?

The average CVSS base score across PHP-Fusion's scored CVEs is 6.3.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

93 CVEs

PHP-Fusion Vulnerabilities

Name: PHP-Fusion vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for PHP-Fusion.

93

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

51

Public exploits

PoC or exploit code

6.3

Avg CVSS

2005–2026

Overview

PHP-Fusion has 93 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 51 have a known public exploit. The average CVSS base score across scored CVEs is 6.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting PHP-Fusion products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on PHP-Fusion's vulnerability posture, as a share of its 93 published CVEs.

Average CVSS: 6.3
Critical / high: 42%
Actively exploited (KEV): 0%
Public exploit available: 55%
Patch available: 14%

Severity and exploitation

How the CVSS severity of PHP-Fusion's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High37

Medium52

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of PHP-Fusion's CVEs are currently listed in CISA's KEV catalog.

Public exploits

51

51 of PHP-Fusion's CVEs have a known public exploit available.

Most affected products

The PHP-Fusion products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in PHP-Fusion CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish PHP-Fusion CVE records.

Disclosure activity by year

How many PHP-Fusion CVEs were published each year.

2017

1

2019

1

2020

11

2021

14

2022

2

2023

3

2025

1

2026

3

Latest PHP-Fusion CVEs

The most recently disclosed vulnerabilities affecting PHP-Fusion.

PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
CWE-79
Medium · CVSS 5.1
EPSS 0.2%2026-02-05
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
CWE-95
High · CVSS 8.6
EPSS 0.5%2026-02-05
PHPFusion 9.03.50 - Persistent Cross-Site Scripting
CWE-79
Medium · CVSS 5.1
EPSS 0.2%2026-01-30
PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload
CWE-79
Medium · CVSS 5.1
EPSS 0.2%2025-12-17
Medium vulnerability · 2023-09-05
CWE-538
Medium · CVSS 5.5
EPSS 0.6%2023-09-05
High vulnerability · 2023-09-05
CWE-829
High · CVSS 8.8
EPSS 0.7%2023-09-05
High vulnerability · 2023-02-17
CWE-732
High · CVSS 8.1
EPSS 0.6%2023-02-17
High vulnerability · 2022-09-07
CWE-620
High · CVSS 8.8
EPSS 0.7%2022-09-07
Medium vulnerability · 2022-02-17
Medium · CVSS 6.1
EPSS 0.8%2022-02-17
Critical vulnerability · 2021-11-02
Critical · CVSS 9.6
EPSS 1.6%2021-11-02
High vulnerability · 2021-10-11
High · CVSS 7.2
EPSS 1.3%2021-10-11
High vulnerability · 2021-10-11
High · CVSS 7.2
EPSS 1.7%2021-10-11

Track new PHP-Fusion CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor PHP-Fusion CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

axiomthemes94 CVEs Belkin94 CVEs Comodo94 CVEs linecorp93 CVEs BMC Software93 CVEs FlowiseAI93 CVEs Silicon Labs93 CVEs silverstripe93 CVEs

Browse all vendors

Frequently asked questions

Common questions about PHP-Fusion vulnerabilities.

How many CVEs does PHP-Fusion have?: PHP-Fusion has 93 published CVE records since 2005, including 4 in the last two years.
How many PHP-Fusion CVEs are in CISA KEV?: None of PHP-Fusion's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which PHP-Fusion products have the most CVEs?: The PHP-Fusion products with the most published CVEs are PHP-Fusion, PHP Fusion, PHPFusion, expanded calendar module, phpfusion/phpfusion.
What are the most common weakness types in PHP-Fusion CVEs?: PHP-Fusion's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), CWE-620 (Unverified Password Change), CWE-732 (Incorrect Permission Assignment for Critical Resource).
Are there public exploits for PHP-Fusion vulnerabilities?: Yes — 51 of PHP-Fusion's CVEs have a known public exploit.
How many critical PHP-Fusion vulnerabilities are there?: PHP-Fusion has 2 critical and 37 high-severity CVEs.
What is the average severity of PHP-Fusion CVEs?: The average CVSS base score across PHP-Fusion's scored CVEs is 6.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track PHP-Fusion vulnerabilities

Monitor new PHP-Fusion vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing