Description

An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.

Remediation

References

CVE-2020-23178

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-4046)

Plone CMS Improper Access Control Vulnerability (CVE-2015-7315)

WordPress Plugin Contact Form for WordPress-Ultimate Form Builder Lite Cross-Site Scripting (1.3.3)

MyBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-29459)

WordPress Plugin Secure HTML5 Video Player Cross-Site Scripting (3.3)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-294 CVE-2020-23178