CVE-2005-4005: PHP Fusion

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php.

Affected products

• PHP Fusion PHP Fusion: version 6.00.109 only

Published 2005-12-05. Last modified 2026-06-16.