Insufficient Logging

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...

External Control of File Name or Path

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...

Insufficient Logging

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the admin API endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration. An attacker can access sensitive...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the admin API endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration. An attacker can access sensitive...

Arbitrary Argument Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Arbitrary Argument Injection via the escapeLikeWildcards process. An attacker can cause excessive resource consumption and degrade service availability ...

Arbitrary Argument Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Arbitrary Argument Injection via the escapeLikeWildcards process. An attacker can cause excessive resource consumption and degrade service availability ...

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...

Insecure Temporary File

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...

Insecure Temporary File

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

Missing Critical Step in Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

Missing Critical Step in Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

Brute Force

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...

Replay Attack

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Replay Attack through improper handling of the prepareForLogin process. An attacker can gain unauthorized access by replaying a previously captured...