CVE-2020-35687
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox...
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
- Record
CVE-2020-35687- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
- Record
CVE-2020-35687- Updated
- 2026-11-02
EUVDEUVD-2020-23346 No score
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
- Record
EUVD-2020-23346- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hp7-gf4j-8f4c No score
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox...
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
- Record
GHSA-3hp7-gf4j-8f4c- Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message) | 2021-01-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35687 is a medium vulnerability (CVSS 4.3) in Php-fusion Phpfusion, published January 13, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. No source names a fixed version.