PHP-Fusion 9.03 allows XSS via the error_log file.
- https://sec-consult.com/en/blog/advisories/multiple-cross-site-scripting-xss-vulnerabilities-in-php-fusion-cms/
No PoCs found on GitHub currently.