2547 matches found
CVE-2023-1885
CVE-2023-1885 affects thorsten/phpmyfaq prior to 3.1.12. The vulnerability is a stored XSS caused by failure to sanitize user input in the category field name parameter, enabling script execution when affected data is viewed. Remediation: upgrade to version 3.1.12 (fixed). Multiple sources in the...
CVE-2023-1883 Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1758 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
phpMyFAQ 跨站脚本漏洞
phpMyFAQ is a multi-language, fully database-driven FAQ system by Thorsten Rinne, a personal developer. A cross-site scripting vulnerability exists in phpMyFAQ. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...
CVE-2023-1882 Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Cross-site Scripting XSS - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1880 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1886
CVE-2023-1886 affects thorsten/phpMyFAQ prior to version 3.1.12. Authentication bypass by capture-replay is documented in multiple feeds (GitHub commit, GHSA advisory, OSV). The underlying issue allows bypassing login to perform actions such as posting comments, with CVSS 3.1 scores indicating hi...
CVE-2023-1878 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1884 Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting XSS - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
CVE-2023-1886 Authentication Bypass by Capture-replay in thorsten/phpmyfaq
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12...
phpMyFAQ 跨站脚本漏洞
phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A cross-site scripting vulnerability exists in phpMyFAQ versions prior to 3.1.12. An attacker can exploit this vulnerability to perform cross-site scripting attacks...
PT-2023-17315 · Thorsten · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns business logic errors in the thorsten/phpmyfaq GitHub repository. Specifically, users with edit-only permissions could add and delete categories and add FAQs, despite...
PT-2023-17308 · Thorsten · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS, specifically reflected and stored XSS. It occurs because the software fails to properly sanitize user input in the artlang parameter. Th...
CVE-2023-1880
PhpMyFAQ v3.1.11 is vulnerable to reflected XSS via the artlang parameter in send2friend; the issue arises from unsanitized user input in artlang. Unauthenticated users could inject scripts. The remediation is to upgrade to 3.1.12 (patched). No exploitation status is provided in the documents.
PT-2023-17311 · Unknown · Thorsten/Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, when FAQ News is marked as inactive in settings and comments are enabled, it allows...
phpMyFAQ < 3.1.12 Multiple Vulnerabilities
phpMyFAQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if description...
Multiple Stored XSS via mail parameter
Description In PhpMyFaq, while submitting a question, the mail parameter is accepting unsanitized user input which leads to Stored XSS vulnerability, executing on Admin Panel /admin/?action=question. Proof of Concept 1. Go to https://roy.demo.phpmyfaq.de/index.php?action=ask&categoryid=0 1. Fill ...
phpMyFAQ has weak password requirements
Weak password requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12...