GHSA-2WJP-W7G7-H63Q thorsten/phpmyfaq vulnerable to improper access control

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to improper access control

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...

GHSA-3J93-7RF7-P7M6 thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ News link parameter. This has been fixed in 3.1.12...

phpMyFAQ 安全漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

PT-2023-17315 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns business logic errors in the thorsten/phpmyfaq GitHub repository. Specifically, users with edit-only permissions could add and delete categories and add FAQs, despite...

Cyber Insurance Coverage FAQ with DataStream CEO

To help organizations simplify the cyber insurance process and understand the must-have security controls involved, Trend Micro Cyber Risk Specialist, Vince Kearns, and Data Stream CEO and Co-Founder, Andy Anderson, examine cyber insurance coverage along with approaches to strengthening...

Multiple Stored XSS via mail parameter

Description In PhpMyFaq, while submitting a question, the mail parameter is accepting unsanitized user input which leads to Stored XSS vulnerability, executing on Admin Panel /admin/?action=question. Proof of Concept 1. Go to https://roy.demo.phpmyfaq.de/index.php?action=ask&categoryid=0 1. Fill ...

CVE-2023-0370

The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0370

The CVE affects the WordPress plugin WPB Advanced FAQ, versions 1.0.0 through 1.0.6. The vulnerability stems from inadequate validation and escaping of certain shortcode attributes, allowing stored XSS when the shortcode is embedded in a page/post. Impact: attackers with the contributor role or h...

CVE-2023-0370 WPB Advanced FAQ <= 1.0.6 - Contributor+ Stored XSS

The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-22678

Cross-Site Request Forgery CSRF vulnerability in Rafael Dery Superior FAQ plugin = 1.0.2 versions...

CVE-2023-22678

Cross-Site Request Forgery CSRF vulnerability in Rafael Dery Superior FAQ plugin = 1.0.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Rafael Dery Superior FAQ plugin = 1.0.2 versions...

CVE-2023-22678

This CVE concerns the WordPress plugin Superior FAQ by Rafael Dery, affected versions are

CVE-2023-22678 WordPress Superior FAQ Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Rafael Dery Superior FAQ plugin = 1.0.2 versions...

WordPress plugin WPB Advanced FAQ 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-18622 · Unknown · Rafael Dery Superior Faq Plugin

Name of the Vulnerable Software and Affected Versions: Rafael Dery Superior FAQ plugin versions = 1.0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

WordPress Plugin Superior FAQ 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...