1868 matches found
CVE-2018-16650
phpMyFAQ before 2.9.11 allows CSRF...
Cross site request forgery (csrf)
phpMyFAQ before 2.9.11 allows CSRF...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
Design/Logic Flaw
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16650
phpMyFAQ before 2.9.11 allows CSRF...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The CVE-2018-16651 entry applies to phpMyFAQ (admin backend) before version 2.9.11, where CSV injection in reports is possible due to insufficient sanitization of report content. The vulnerability is reflected with a HIGH CVSS score (3.0: 7.2; 2.0: 9.0) and can impact multiple CIA aspects as defi...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16650
CVE-2018-16650 refers to a CSRF vulnerability in phpMyFAQ versions before 2.9.11 . The issue arises from insufficient CSRF protection, allowing an attacker to perform unauthorized admin actions. Affected product/version: phpMyFAQ up to 2.9.10. Impact indicators show exposure of admin operations; ...
CVE-2018-16650
phpMyFAQ before 2.9.11 allows CSRF...
phpMyFAQ Cross-Site Request Forgery Vulnerability (CNVD-2019-07200)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...
phpMyFAQ CSV Injection Vulnerability
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A CSV injection vulnerability exists in the admin...
phpMyFAQ SQL Injection Vulnerability (CNVD-2018-16949)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A SQL injection vulnerability exists in versions...
phpMyFAQ Cross-Site Request Forgery Vulnerability (CNVD-2018-17637)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...
Unauthenticated Read Access
phpMyFAQ/phpMyFAQ is vulnerable to unauthenticated read access. The vulnerability exists as there was a lack of check on whether an attachment was being requested and read by an unauthenticated user...
Authorization Bypass
phpmyfaq/phpmyfaq is vulnerable to authorization bypasses. The library does not properly handle the instance ID, allowing a malicious user with admin rights to delete a multi-site master instance...
SQL Injection
phpMyFAQ/phpMyFAQ is vulnerable to SQL Injections. The library does not properly escape parameters in the SQL query executed by the restore function, allowing malicious users to inject and execute arbitrary SQL queries...
Bypass Protection Mechanism
phpMyFAQ/phpMyFAQ is vulnerable to bypassing protection mechanism. Due to the flaw in Captcha implementation, an attacker can bypass the Captcha protections on forms by replaying the request...
Cross Site Request Forgery (CSRF)
phpMyFAQ/phpMyFAQ is vulnerable to cross-site request forgery CSRF. The vulnerability exists because it does not check CSRF token properly in user.php, allowing the attacker to delete any active user, to remove open questions, to manipulate FAQ and FAQ news, to add votes and to add or delete...
Authorization Bypass
phpMyFAQ/phpMyFAQ is affected by an authorization bypass. A remote authenticated user, with the privileges Right to add attachments and Right to delete attachments but without the privilege Right to download the attachments, is able to download and read arbitrary attachments due to incorrect...