Description PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag. References 14332 vdb-entry 18111 vdb-entry 16096 third-party-advisory