Vulnerability · Published Feb 5, 2026 · Assigned by VulnCheck

CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)

Medium 5.1

In plain English

A medium-severity cross-site scripting in PHP-Fusion from PHP-Fusion. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.

Affected products (as reported)

Vendor	Product	Versions
PHP-Fusion	PHP-Fusion	9.03.50

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

Vendor Homepage product
ExploitDB-48299 exploit
VulnCheck Advisory: PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS) third-party-advisory