CVE-2020-14960

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/php-fusion/PHP-Fusion/commit/b3bde37f60e96f1a8ddd1439658307b28be77db5Patch, Third Party Advisory
https://github.com/php-fusion/PHP-Fusion/issues/2327Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/48487Exploit, Third Party Advisory, VDB Entry
https://github.com/php-fusion/PHP-Fusion/commit/b3bde37f60e96f1a8ddd1439658307b28be77db5Patch, Third Party Advisory
https://github.com/php-fusion/PHP-Fusion/issues/2327Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/48487Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jun 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-149615.3Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.CVE-2020-149625.4Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web sc CVE-2020-149654.8On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML conte CVE-2020-149667.5An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking ov CVE-2020-149679.8An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect cip CVE-2020-149689.8An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signatur CVE-2020-149697.5app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch AP CVE-2020-14975.5An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploit CVE-2020-149717.8Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then resto CVE-2020-149729.8Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass CVE-2020-149736.1The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via CVE-2020-149747.1The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that hold