1985 matches found
CVE-2006-6912
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter...
CVE-2006-6913
Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors...
CVE-2006-6912
phpMyFAQ is affected by SQL injection in versions up to 1.6.7 (and advisories also reference
CVE-2006-6913
CVE-2006-6913 affects phpMyFAQ 1.6.7 and earlier. An unspecified vulnerability allows remote attackers to upload arbitrary PHP scripts via unspecified vectors. Multiple reports reference this entry and describe the ability to upload executable files, but the exact vectors, affected components, an...
phpMyFAQ < 1.6.8 Multiple Vulnerabilities
Binary data 3880.prm...
CVE-2006-6912
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter...
CVE-2006-6913
Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors...
[Full-disclosure] phpmyfaq exploit using PHP bug, CVE-2006-1490
Long time ago I made unneccesary noise about PHP zeroday. I expected it to be maybe much more dangerous that it appeared to be at end. There was lot of disscussions and one of main consensus was that this bug is not exploitable in real world because noone is using those vulnerable functions. This...
FreeBSD : phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution (c6b9aee8-3071-11da-af18-000ae4641456)
If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible to overwrite the admin password and to take over the whole system. In some files in the admin section there are some cross site scripting vulnerabilities. In the public frontend it's possible to inclu...
CVE-2005-3734
The CVE-2005-3734 entry describes a Cross-site scripting (XSS) vulnerability in the phpMyFAQ 1.5.3 and earlier "add content" page. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) thema, (2) username, and (3) usermail parameters. Affected product: phpMyFAQ (ver...
CVE-2005-3734
Cross-site scripting XSS vulnerability in the "add content" page in phpMyFAQ 1.5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 thema, 2 username, and 3 usermail parameters...
TKADV2005-11-004.txt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: Multiple Cross Site Scripting vulnerabilities in phpMyFAQ Name: TKADV2005-11-004 Revision: 1.0 Release Date: 2005/11/19 Last Modified: 2005/11/19 Author: Tobias Klein tk at trapkit.de Affected Software: phpMyFAQ all versions = phpMyFAQ 1.5.3...
[TKADV2005-11-004] Multiple Cross Site Scripting vulnerabilities in phpMyFAQ
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: Multiple Cross Site Scripting vulnerabilities in phpMyFAQ Name: TKADV2005-11-004 Revision: 1.0 Release Date: 2005/11/19 Last Modified: 2005/11/19 Author: Tobias Klein tk at trapkit.de Affected Software: phpMyFAQ all versions = phpMyFAQ 1.5.3...
phpMyFAQ action parameter arbitrary file disclosure vulnerability
The remote web server contains a PHP script that permits information disclosure of local files. Description : The version of phpMyFAQ on the remote host contains a flaw that may lead to an unauthorized information disclosure. The problem is that user input passed to the 'action' parameter is not...
phpMyFAQ < 1.3.12 Directory Traversal Vulnerability
The remote web server contains a PHP script that permits information disclosure of local files. The version of phpMyFAQ on the remote host contains a flaw that may lead to an unauthorized information disclosure. The problem is that user input passed to the SPDX-FileCopyrightText: 2004 David...
PhpMyFAQ 1.5.1 multiple vulnerabilities
2.31 23/09/2005 PhpMyFaq 1.5.1 SQL injection / board takeover / user info disclosure / path disclosure remote code / commands execution software: site: http://www.phpmyfaq.de/ description: "phpMyFAQ is a multilingual, completely database-driven FAQ-system. It supports various databases to store a...
phpMyFAQ < 1.5.2 Multiple Vulnerabilities
The remote host is running a version of phpMyFAQ that suffers from arbitrary code execution if the server is Windows-based, SQL injection and cross-site scripting attacks, as well as information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
CVE-2005-3048
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. dot dot in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated ...
CVE-2005-3047
Multiple cross-site scripting XSS vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 PMFCONFversion parameter to footer.php or 2 PMFLANGmetaLanguage to header.php...