CVE-2019-12099

In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload.

• CWE-434

• https://github.com/php-fusion/PHP-Fusion/commit/943432028b9e674433bb3f2a128b2477134110e6Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/46839Exploit, Third Party Advisory, VDB Entry
• https://www.pentest.com.tr/exploits/PHP-Fusion-9-03-00-Edit-Profile-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://github.com/php-fusion/PHP-Fusion/commit/943432028b9e674433bb3f2a128b2477134110e6Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/46839Exploit, Third Party Advisory, VDB Entry
• https://www.pentest.com.tr/exploits/PHP-Fusion-9-03-00-Edit-Profile-Remote-Code-Execution.htmlExploit, Third Party Advisory

Published

May 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1209An information disclosure vulnerability exists in Lync 2013,…6.5
• CVE-2019-12091The Netskope client service, v57 before 57.2.0.219 and v60 b…7.8
• CVE-2019-12094Horde Groupware Webmail Edition through 5.2.22 allows XSS vi…6.1
• CVE-2019-12095Horde Trean, as used in Horde Groupware Webmail Edition thro…8.8
• CVE-2019-12097Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of …
• CVE-2019-12098In the client side of Heimdal before 7.6.0, failure to verif…7.4
• CVE-2019-1210Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12101coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandl…
• CVE-2019-12102Kentico 11 through 12 lets attackers upload and explore file…
• CVE-2019-12103The web-based configuration interface of the TP-Link M7350 V…
• CVE-2019-12104The web-based configuration interface of the TP-Link M7350 V…
• CVE-2019-12105In Supervisor through 4.0.2, an unauthenticated user can rea…8.2