CVE-2020-35952: PHP-Fusion

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

login.php in PHPFusion (aka PHP-Fusion) Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password (i.e., not a single "Incorrect username or password" message in both cases), which might allow enumeration.

Affected products

• PHP-Fusion PHP-Fusion: from 9.0, before 9.03.90 (fixed in 9.03.90)

Published 2021-01-03. Last modified 2026-06-17.