Vulnerability · Published Feb 5, 2026 · Assigned by VulnCheck
CVE-2020-37137PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
Medium 6.1
In plain English
A medium-severity security flaw in PHP Fusion from PHP Fusion. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 50.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHP Fusion | PHP Fusion | 9.03.50 |
Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-48278 exploit
- PHP Fusion Official Website product
- VulnCheck Advisory: PHP-Fusion 9.03.50 - 'panels.php' Eval Injection third-party-advisory