CVE-2020-35687

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-35698.6Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthentCVE-2020-356938.8On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) devicCVE-2020-356986.1Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (rCVE-2020-357008.8A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 alloCVE-2020-357018.8An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackersCVE-2020-357027.8DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indiCVE-2020-357045.4Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.CVE-2020-357055.4Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.CVE-2020-357065.4Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.CVE-2020-357075.4Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.CVE-2020-357087.2phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.CVE-2020-357094.9bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the
CVE-2020-35687: Medium severity, CVSS 4.3 | Vulnix