CVE-2024-29196

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6...

CVE-2024-27300

Summary: CVE-2024-27300 affects phpMyFAQ; the vulnerability is a stored XSS in the user email field caused by inadequate validation from PHP’s FILTER_VALIDATE_EMAIL. An attacker can inject JavaScript that is stored and later rendered in another user’s session. The issue is documented across multi...

Design/Logic Flaw

phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a...