SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

Improper Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the htmlentitydecode process. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient permission checks on admin content pages. An attacker can access unpublished content by leveraging add...

Improper Control of Interaction Frequency

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Control of Interaction Frequency via the store parameter in question submission requests. An attacker can submit unlimited questions without...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the data export process. An attacker can obtain TOTP shared secrets in plaintext by accessing exported user data ZIP archives,...

Unverified Password Change

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unverified Password Change via the user control panel API endpoint. An attacker can gain unauthorized access to user accounts by submitting a crafted PU...

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the FaqHelper::convertOldInternalLinks process, which calls htmlentitydecode on sanitized FAQ content, reversing...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the Dashboard API endpoints searches and content-health, which enforce only authentication without proper permission checks. A...

Use of Single-factor Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication through the removeTwofactorConfig process and the twofactorenabled form field, which are accessible via POST...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization in the question/create endpoint due to the isAddingQuestionsAllowed method granting access to all callers when...

WS-2023-0367

stored XSS Bypass in the FAQ Fields in thorsten/phpmyfaq...

WS-2023-0333

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17...

WS-2022-0427

thorsten/phpmyfaq prior to 3.1.9 is vulnerable to SQL injection via the lang parameter of phpmyfaq/ajaxservice.php?action=savefaq endpoint. It is able to bypass faqLanguage whitelisting by specifying a rubrik POST parameter. The impact depends on the database engine used. For MySQL database engin...

WS-2022-0432

There is a SQL injection vulnerability inside saveMeta function in AttachmentAbstract.php in thorsten/phpmyfaq prior to 3.1.9. When a file is being uploaded via admin/index.php?action=ajax&ajax=att&ajaxaction=upload endpoint, the filename parameter isn't being sanitized and its later on...

WS-2022-0431

A stored Scross-Site Scripting XSS exists inside Admin logs in thorsten/phpmyfaq prior to 3.1.9...

WS-2022-0424

thorsten/phpmyfaq before 3.1.9 is vulnerable to SQL Injection inside instance name that leads to Remote Code Execution. An attacker has a severe impact by being allowed to recover all or part of your database including sensitive data like usernames and passwords hash, Modify or insert data in the...

WS-2022-0430

There is a stored XSS vulnerability due to improper sanitization of usernames in GitHub repository thorsten/phpmyfaq prior to 3.1.9. This may lead to privilege escalation from an unauthenticated user to super-admin. This is because it is possible to ride admin's session and add another superuser...

WS-2022-0428

A Stored Cross Scripting XSS vulnerability exists in thorsten/phpmyfaq prior to 3.1.9. If a user inject an XSS payload inside a category name. All users that visit the index page will execute the corresponding XSS payload...

WS-2022-0426

thorsten/phpmyfaq prior to 9.1.3 is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is exploited when an administrator inserts an XSS payload inside the website title...