CVE-2021-28280: PHP-Fusion Phpfusion

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML

Affected products

• PHP-Fusion Phpfusion: version 9.03.110 only

Published 2021-04-29. Last modified 2026-06-17.