CVE-2024-28108

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding n...

CVE-2024-28108 phpMyFAQ Stored HTML Injection at contentLink

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding n...

WordPress Knowledge Base for Documentation, FAQs with AI Assistance Plugin <= 11.30.2 is vulnerable to PHP Object Injection

Software Knowledge Base for Documentation, FAQs with AI Assistance Type Plugin Vulnerable versions = 11.30.2 Fixed in 11.31.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24842 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID 6e74033eecde...

[SECURITY] [DLA 3489-1] mediawiki security update

Debian LTS Advisory DLA-3489-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 10, 2023 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.31.16-1+deb10u5 CVE ID : CVE-2022-47927 A security issue was discovered in MediaWiki, a website engine for...

Stored Xss in Question field due to lack of sanitization in Link.php

Description Stored XSS Cross-Site Scripting is a type of web application vulnerability that allows an attacker to inject malicious scripts into a website or web application. Unlike reflected XSS, where the malicious script is embedded in a URL and executed immediately, stored XSS involves the...

Veeam Cloud Service Provider Case Administrator FAQ

Intended Audience This article contains information that is relevant to Veeam Cloud Service Providers. If you are not a Veeam Cloud Service Provider, please review the following: KB2211: My Account Portal - Role Management FAQ Case Administrator Assignment Restrictions Attempting to assign a case...

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service RaaS scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB. The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the...

CVE-2023-25962

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin = 2.3.0 versions...

CVE-2023-25962

The CVE-2023-25962 entry concerns the WordPress plugin Accordion – Multiple Accordion or FAQs Builder. A stored XSS vulnerability affects versions

CVE-2023-25962: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Biplob Adhikari Accordion – Multiple Accordion or FAQs Builder plugin = 2.3.0 versions...

WordPress plugin Accordion – Multiple Accordion or FAQs Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Accordion - Multiple Accordion or FAQs...

CVE-2023-2204

A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file faqs.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...

PT-2023-18364

Name of the Vulnerable Software and Affected Versions Campcodes Retro Basketball Shoes Online Store version 1.0 Description A critical issue has been found in the software, affecting an unknown functionality of the file faqs.php. The manipulation of the id argument leads to SQL injection. This...

Campcodes Retro Basketball Shoes Online Store SQL注入漏洞

Campcodes Retro Basketball Shoes Online Store is an online store for retro basketball shoes from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Retro Basketball Shoes Online Store version 1.0, which stems from a SQL injection vulnerability in the parameter id of the file faqs.p...

[SECURITY] [DLA 3395-2] golang-1.11 regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3395-2 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 20, 2023 https://wiki.debian.org/LTS -...

Business Logic Flaws

phpmyfaq is vulnerable to Business Logic Flaws. The vulnerability exists in record.add.php due to improper user permission checks which allows an authenticated attacker with edit-only permissions to add and delete categories or add FAQs...

GHSA-2WJP-W7G7-H63Q thorsten/phpmyfaq vulnerable to improper access control

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12...

CVE-2023-26858

SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component...

CVE-2023-26858

SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component...

Sql injection

SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component...