CVE-2014-8596: PHP-Fusion

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) submit_id parameter in a 2 action to files/administration/submissions.php or (2) status parameter to files/administration/members.php.

Affected products

• PHP-Fusion PHP-Fusion: version 7.02.07 only

Published 2014-11-17. Last modified 2026-06-17.