CVE-2023-2429

The CVE-2023-2429 issue affects thorsten/phpmyfaq prior to 3.1.13, with an improper access control flaw related to user profile updates. The OpenVAS/OSV/GHSA entries describe that the vulnerability stems from insufficient validation of email addresses during user-profile changes, enabling an atta...

Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-site Scripting XSS. The vulnerability exists in user.php because the username parameter is not properly sanitized which allows an attacker to inject and execute arbitrary javascript...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. A cross-site scripting vulnerability exists in phpMyFAQ Cross-Site Scripting Vulnerability. No information about this vulnerability is available at this time, so stay tuned to CNNVD or vendor...

GHSA-CH5W-2994-6H82 Cross-site Scripting in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1875 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

PT-2023-17303 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the thorsten/phpmyfaq GitHub repository. Recommendations: For versions prior to 3.1.12, update to version 3.1.12 ...

CVE-2023-1875

CVE-2023-1875 describes a stored Cross-site Scripting (XSS) vulnerability in the phpMyFAQ project by thorsten/phpmyfaq, affecting versions prior to 3.1.12. The vulnerability allows injection into user-facing pages stored on the server. Reported across multiple sources confirms the issue and recom...

Stored Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists due to the improper sanitization in the adminlog of the stat.adminlog.php, which allows an attacker to inject and execute malicious JavaScript through the $text attribute...

Privilege Escalation

thorsten/phpmyfaq is vulnerable to Privilege Escalation. The vulnerability exists because of the insufficient permission checks in the user.php, which allows an attacker to gain escalated privilege through the isSuperAdmin feature...

GHSA-GCMQ-7652-X98J thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the adminlog. This has been fixed in 3.1.12...

GHSA-JVJX-QQH7-6X6C thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ News link parameter. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to authentication bypass

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to authentication bypass by capture-relay that allows unlimited comments to be sent. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to cross-site scripting XSS because it fails to sanitize user input in the stopword parameter. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the updatecategory parameter. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the category field name parameter. This has been fixed in 3.1.12...

thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...

GHSA-GX43-FQRX-6FCW thorsten/phpmyfaq vulnerable to business logic errors

thorsten/phpmyfaq prior to 3.1.12 allows users with edit-only permissions to add and delete categories and add FAQs. This has been fixed in 3.1.12...

GHSA-GMJJ-G2RM-XWM7 thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to cross-site scripting XSS because it fails to sanitize user input in the stopword parameter. This has been fixed in 3.1.12...

GHSA-M9QM-M5W5-9PGJ thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the updatecategory parameter. This has been fixed in 3.1.12...

GHSA-3J93-7RF7-P7M6 thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting XSS because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12...