Stored Cross-site scripting

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Proof of Concept Visit: http:///phpmyfaq/admin/?action=meta Click button Add template meta data Inject payload in field Page type: "alert"XSS"...

GHSA-6RJ8-9CM9-6GFF phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

CVE-2022-3608

CVE-2022-3608 affects phpMyFAQ versions prior to 3.2.0-alpha, with stored XSS in the codebase hosted under thorsten/phpmyfaq. Multiple sources describe a stored XSS vulnerability exploited via user input that can affect multiple pages and is tied to the repository before 3.2.0-alpha. The issue is...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in versions prior to phpMyFAQ 3.2.0-alpha. An attacker exploited the vulnerability to perform cross-site scripting attacks...

PT-2022-23168 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.0-alpha Description: The issue is related to stored Cross-site Scripting XSS in the phpMyFAQ repository. A patch for this issue is available on the main branch of the repository and is expected to be included in...

CVE-2022-3608 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha...

CVE-2022-3608 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha...

Stored XSS and possible RCE/LFI in case of misconfiguration

Description phpmyfaq has a feature to restore from a backup the entire application. An attacker with admin grant can export the configuration and re-upload the same file bypassing all the backend sanitization and controls. Proof of Concept XSS 1. - login as admin 2. - go to backup page 3. - Creat...

phpmyfaq -- CSRF vulnerability

phpmyfaq developers report: phpMyFAQ does not implement sufficient checks to avoid CSRF when logging out an user...

GHSA-P57W-9Q28-J6V7 phpMyFAQ CSRF

phpMyFAQ before 2.9.11 allows CSRF...

phpMyFAQ CSRF

phpMyFAQ before 2.9.11 allows CSRF...

Cross-Site Request Forgery (CSRF) in thorsten/phpmyfaq

Description Hi there, another CSRF in clearing search items. Proof of Concept 1. Install a local instance of phpmyfaq. 2. Go to this link /phpmyfaq/admin/?action=truncatesearchterms 3. See that all search terms are deleted. Impact This vulnerability is capable of CSRF...

Cross-Site Request Forgery (CSRF) in thorsten/phpmyfaq

Description Hi there, there is a CSRF in your logout function. This will force admin to logout if he/she clicks on the link attacker gives him. Proof of Concept 1. Install phpmyfaq on your system. 2. Login as admin 3. Open this link /admin/index.php?action=logout 4. See that you are logged out of...

Cross-Site Request Forgery (CSRF) in thorsten/phpmyfaq

Description Hi there phpmyfaq team, I would like to report a Cross site request Forgery in phpmyfaq. It is in publishing question. Cross-site request forgery also known as CSRF is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to...

FreeBSD : phpmyfaq -- XSS vulnerability (1f655433-551b-11eb-9cda-589cfc0f81b0)

phpmyfaq developers report : phpMyFAQ does not implement sufficient checks to avoid XSS injection for displaying tags. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...

phpmyfaq -- XSS vulnerability

phpmyfaq developers report: phpMyFAQ does not implement sufficient checks to avoid XSS injection for displaying tags...

phpMyFAQ <= 2.9.10 Multiple Vulnerabilities

phpMyFAQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if description...

Cross-Site Request Forgery (CSRF)

phpMyFAQ is vulnerable to cross-site request forgery. An attacker is able activate any user on behalf of the administrator by tricking the victim into visiting a malicious site...

CSV Injection

phpmyfaq/phpmyfaq is vulnerable to CSV injection attacks. The vulnerability exists due to the lack of sanitization of characters that allows a string to be interpreted as a formula...