CVE-2020-37152 PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)
Attackers can inject arbitrary JavaScript via the panel_content parameter in PHP-Fusion, leading to script execution in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-37152?
CVE-2020-37152 is a medium-severity cross-site scripting vulnerability in PHP-Fusion, published on 5 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The application fails to properly sanitize user input before rendering it in the browser, allowing attackers to inject arbitrary JavaScript. This can be exploited by submitting crafted input to the 'panel_content' field in panels.php, resulting in execution of malicious scripts in the context of the affected site.
Weakness: CWE-79
Which versions are affected by CVE-2020-37152?
It affects 1 product.
Products include Php-Fusion Phpfusion.
How do I fix CVE-2020-37152?
No fix has been published for CVE-2020-37152 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-37152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37152 exists.
Other vulnerabilities in PHP-Fusion
Sources
Also known as GHSA-f282-2298-ffhh.