CVE-2023-1886

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1880

Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1885

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1758 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1886

CVE-2023-1886 affects thorsten/phpMyFAQ prior to version 3.1.12. Authentication bypass by capture-replay is documented in multiple feeds (GitHub commit, GHSA advisory, OSV). The underlying issue allows bypassing login to perform actions such as posting comments, with CVSS 3.1 scores indicating hi...

CVE-2023-1878 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1880

PhpMyFAQ v3.1.11 is vulnerable to reflected XSS via the artlang parameter in send2friend; the issue arises from unsanitized user input in artlang. Unauthenticated users could inject scripts. The remediation is to upgrade to 3.1.12 (patched). No exploitation status is provided in the documents.

CVE-2023-1884 Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

Cross-site Scripting XSS - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1757 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1879 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

PT-2023-17306 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to stored Cross-site Scripting XSS due to the failure to sanitize user input in the adminlog. This has been fixed in version 3.1.12. Recommendations: For versions...

CVE-2023-1878 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1887 Business Logic Errors in thorsten/phpmyfaq

Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1885 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1884 Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

Cross-site Scripting XSS - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1882 Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

Cross-site Scripting XSS - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

PT-2023-17308 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS, specifically reflected and stored XSS. It occurs because the software fails to properly sanitize user input in the artlang parameter. Th...

CVE-2023-1885

CVE-2023-1885 affects thorsten/phpmyfaq prior to 3.1.12. The vulnerability is a stored XSS caused by failure to sanitize user input in the category field name parameter, enabling script execution when affected data is viewed. Remediation: upgrade to version 3.1.12 (fixed). Multiple sources in the...

CVE-2023-1886 Authentication Bypass by Capture-replay in thorsten/phpmyfaq

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

PT-2023-17315 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns business logic errors in the thorsten/phpmyfaq GitHub repository. Specifically, users with edit-only permissions could add and delete categories and add FAQs, despite...