337 matches found
CVE-2023-0307 Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
PT-2023-16164 · Unknown · Thorsten/Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.10 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts...
CVE-2023-0314 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2023-0313 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4409 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4408 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4408
phpMyFAQ is affected up to version 3.1.8 with a stored Cross-site Scripting (XSS) vulnerability. The issue arises from handling user input stored in the database (GitHub repo thorsten/phpmyfaq). Impact is XSS in affected users’ browsers. Remediation: upgrade to version 3.1.9 or later; as a workar...
CVE-2022-4407
CVE-2022-4407 affects phpMyFAQ versions before 3.1.9. The vulnerability is a reflected XSS in the admin area (e.g., action parameter in phpmyfaq/admin/index.php), caused by unsanitized user input being echoed into HTML attributes. Multiple sources (NVD entry, Exploit-DB PoC for 3.1.7, OSV/CIRCL s...
CVE-2022-4409
CVE-2022-4409 affects the PHPMyFAQ project (thorsten/phpmyfaq), where in versions prior to 3.1.9 a sensitive cookie used in HTTPS sessions is set without the Secure attribute. This can expose session data over non-secure channels. The public records consistently identify the issue as a cookie sec...
CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4408 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
Authentication Bypass
thorsten/phpmyfaq is vulnerable to authentication bypass. The vulnerability exists due to lack of restrictions in the password change function which allows an attacker to successfully update the password by changing one character...
Cross-Site Scripting (XSS)
thorsten/phpmyfaq is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to missing quoting for search terms which allows an attacker to inject arbitrary html and script code into the web site...
CVE-2022-3766
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8...
CVE-2022-3766 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8...
CVE-2022-3766
CVE-2022-3766 affects phpMyFAQ versions prior to 3.1.8. The nuclei template and related sources describe a reflected Cross-Site Scripting (XSS) vulnerability in the search functionality, where user input is not properly sanitized, allowing injected JavaScript to execute in other users’ browsers. ...
CVE-2022-3765
CVE-2022-3765 is a stored Cross-site Scripting (XSS) vulnerability affecting phpMyFAQ versions prior to 3.1.8 (repository: thorsten/phpmyfaq). The incident is described across multiple sources as storing unvalidated user input that can be delivered to other users, with the impacted component bein...