CVE-2023-2427

The CVE-2023-2427 vulnerability affects phpMyFAQ (Thorsten Rinne) prior to version 3.1.13 and is a reflected Cross-site Scripting (XSS) flaw. Attackers could leverage reflected input to execute script in a user’s browser, with potential cookie access as indicated by multiple sources. The only fix...

CVE-2023-2550

CVE-2023-2550 describes a stored Cross-site Scripting (XSS) vulnerability in the PHPMyFAQ project prior to version 3.1.13. The vulnerability arises from unfiltered user input stored and later displayed, with multiple sources explicitly stating XSS in thorsten/phpmyfaq before 3.1.13. Public adviso...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.1.13, which can be exploited by attackers to steal user cookies...

CVE-2023-2427 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13...

phpMyFAQ < 3.1.13 Multiple Vulnerabilities

phpMyFAQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if description...

phpmyFAQ < 3.2.0-beta.2 XSS Vulnerability

phpMyFAQ is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"...

phpMyFAQ 3.1.12 CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

Stored XSS bypass in "FAQ"

Description Stored XSS in "Add new FAQ" feature via inject XSS payload in the answer at the following https://roy.demo.phpmyfaq.de/admin/?action=editentry Steps 1- Login as admin and Go to the following URL https://roy.demo.phpmyfaq.de/admin/?action=editentry to add a new faq 2-Enter the "Questio...

phpMyFAQ v3.1.12 - CSV Injection Vulnerability

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

phpMyFAQ v3.1.12 - CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

phpMyFAQ Improper Access Control vulnerability

phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to...

GHSA-R69V-Q48G-3966 phpMyFAQ Improper Access Control vulnerability

phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to...

phpMyFAQ vulnerable to Stored Cross-site Scripting

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...

GHSA-8595-6653-96P2 phpMyFAQ vulnerable to Stored Cross-site Scripting

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...

CVE-2023-2429

Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13...

CVE-2023-2429

Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13...

PT-2023-19516 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.13 Description: The issue is related to improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, phpMyFAQ does not properly validate email addresses when updating user profiles,...

CVE-2023-2428

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13...

CVE-2023-2428 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13...

CVE-2023-2428

This CVE refers to phpMyFAQ prior to version 3.1.13, where a stored XSS vulnerability exists in the name field of the add question module in thorsten/phpmyfaq. The underlying issue is a stored XSS in user-supplied input that is kept in the database and rendered without proper sanitization, enabli...