Filtered by vendor Phpmyfaq
Subscriptions
Filtered by product Phpmyfaq
Subscriptions
Total
127 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-1758 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 5.4 Medium |
| Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1878 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1879 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1880 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 6.1 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1882 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 5.4 Medium |
| Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1883 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 5.4 Medium |
| Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1884 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 6.1 Medium |
| Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1885 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 6.3 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1886 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 7.3 High |
| Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1887 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-10 | 4.3 Medium |
| Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-1875 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-02-04 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||||
| CVE-2023-2429 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-30 | 9.8 Critical |
| Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||||
| CVE-2023-2428 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-30 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||||
| CVE-2023-2427 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-29 | 4.8 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||||
| CVE-2023-2753 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-22 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. | ||||
| CVE-2023-2752 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-22 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. | ||||
| CVE-2023-2998 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-10 | 6.1 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. | ||||
| CVE-2023-2999 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-10 | 6.1 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. | ||||
| CVE-2024-28106 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-09 | 4.3 Medium |
| phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6. | ||||
| CVE-2024-27299 | 1 Phpmyfaq | 1 Phpmyfaq | 2025-01-09 | 8.8 High |
| phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the `authorEmail` field which uses PHP's `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6. | ||||