CVE-2017-7579

inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field...

CVE-2017-7579

inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field...

CVE-2017-7579

inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field...

CVE-2017-7579

CVE-2017-7579 affects phpMyFAQ before 2.9.7, where the file inc/PMF/Faq.php is vulnerable to cross-site scripting through the question field. The root cause is an XSS flaw in the handling of that input, allowing injection of arbitrary web scripts/HTML. Documented impacts indicate an attacker coul...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP filterinput function with FILTERVALIDATEURL flag is used...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP...

phpMyFAQ 2.9.0 Cross Site Scripting

Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP filterinput function with FILTERVALIDATEURL flag is used...

FreeBSD : phpmyfaq -- cross-site request forgery vulnerability (f87a9376-0943-11e6-8fc4-00a0986f28c4)

The phpMyFAQ team reports : The vulnerability exists due to application does not properly verify origin of HTTP requests in 'Interface Translation' functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrato...

phpMyFAQ Cross-Site Request Forgery Vulnerability

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site request forgery vulnerability exists in phpMyFAQ. Due to the application failing to properly validate the 'Interface Translation' translation function of the originating HTTP request. An unauthenticated remote attacker c...

phpMyFAQ 2.8.26 / 2.9.0-RC2 Cross Site Request Forgery

Advisory ID: HTB23300 Product: phpMyFAQ Vendor: http://www.phpmyfaq.de Vulnerable Versions: 2.8.26, 2.9.0-RC2 and probably prior Tested Version: 2.8.26, 2.9.0-RC2 Advisory Publication: March 30, 2016 without technical details Vendor Notification: March 30, 2016 Vendor Patch: April 11, 2016 Public...

phpmyfaq -- cross-site request forgery vulnerability

The phpMyFAQ team reports: The vulnerability exists due to application does not properly verify origin of HTTP requests in "Interface Translation" functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator...

RCE via CSRF in phpMyFAQ

High-Tech Bridge Security Research Lab discovered a high-risk security vulnerability in a popular multilingual FAQ software phpMyFAQ. A remote attacker can execute arbitrary PHP code on vulnerable system via CSRF attack against website administrator and completely compromise vulnerable web...

phpMyFAQ 2.7.9 PHP Code Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : http://0day.today 0 1 + Support e-mail :...

phpMyFAQ 2.8.X - Multiple Vulnerabilities

No description provided by source. Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user session in 'Statistic' tab. Over...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

phpMyFAQ 2.8.x - Multiple Vulnerabilities Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specif...

phpMyFAQ 2.8.X - Multiple Vulnerabilities

Latest phpMyFAQ software suffers on multiple CSRF and XSS vulnerabilities, uh. Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is...

phpMyFAQ 2.5.4 and Prior Multiple Cross Site Scripting Vulnerabilities

漏洞信息： phpMyFAQ是一个多语言，完全数据库驱动的FAQ系统。它支持多种数据库来存储所有数据。 phpMyFAQ的脚本index.php中存在多个跨站脚本攻击漏洞。 漏洞影响： phpMyFAQ phpMyFAQ 2.5.4 phpMyFAQ phpMyFAQ 2.5.2 phpMyFAQ phpMyFAQ 2.5.1 phpMyFAQ phpMyFAQ 2.5 -dev phpMyFAQ phpMyFAQ 2.5 漏洞分析：...

PHPMyFAQ 1.5.1 Password.PHP SQL Injection Vulnerabililty

No description provided by source. source: http://www.securityfocus.com/bid/14927/info phpMyFAQ is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before using it in a SQL query. This vulnerability could permit remo...