How severe is CVE-2020-37137?

CVE-2020-37137 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2020-37137 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-37137?

CVE-2020-37137 affects Php-fusion Phpfusion. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-37137?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2020-37137 have an EU (EUVD) identifier?

Yes. CVE-2020-37137 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-31029.

When was CVE-2020-37137 published?

CVE-2020-37137 was published on 2026-02-05 and last updated on 2026-06-17.

CVE-2020-37137

CVE-2020-37137 is a medium-severity vulnerability in Php-fusion Phpfusion with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v4: 8.6
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2020-31029
Weakness: CWE-94
Affected product: Php-fusion Phpfusion
Published: 2026-02-05
Last modified: 2026-06-17

Description

PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code.

Frequently asked questions

What is CVE-2020-37137?: PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function with unsanitized POST data. Attackers can exploit the vulnerability by sending crafted panel_content POST parameters to the panels.php administration endpoint to execute malicious code.
How severe is CVE-2020-37137?: CVE-2020-37137 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2020-37137 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-37137?: CVE-2020-37137 affects Php-fusion Phpfusion. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-37137?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2020-37137 have an EU (EUVD) identifier?: Yes. CVE-2020-37137 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-31029.
When was CVE-2020-37137 published?: CVE-2020-37137 was published on 2026-02-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:php-fusion:phpfusion:9.03.50:*:*:*:*:*:*:*

More vulnerabilities in Php-fusion Phpfusion

CVE-2020-23754 — Critical (CVSS 9.6): Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows…
CVE-2023-2453 — High (CVSS 8.8): There is insufficient sanitization of tainted file names that are directly concatenated with a path that is…
CVE-2022-3152 — High (CVSS 8.8): Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
CVE-2021-40189 — High (CVSS 7.2): PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to…
CVE-2021-40188 — High (CVSS 7.2): PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does…
CVE-2020-37152 — Medium (CVSS 6.1): PHP-Fusion 9.03.50 panels.php is vulnerable to cross-site scripting (XSS) via the 'panel_content' POST parameter. The…

All CVEs affecting Php-fusion Phpfusion →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →