337 matches found
CVE-2023-0312 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2023-0306 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2023-0308
The CVE-2023-0308 entry corresponds to a Stored Cross-Site Scripting (XSS) vulnerability in the PHP FAQ project phpMyFAQ, affecting the Thorsten/phpmyfaq repository when running versions prior to 3.1.10. Publicly documented references (NVD entry and related advisories) consistently describe the v...
CVE-2023-0313 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10...
CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4408 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4408 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4409
CVE-2022-4409 affects the PHPMyFAQ project (thorsten/phpmyfaq), where in versions prior to 3.1.9 a sensitive cookie used in HTTPS sessions is set without the Secure attribute. This can expose session data over non-secure channels. The public records consistently identify the issue as a cookie sec...
CVE-2022-4409 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9...
CVE-2022-4407
CVE-2022-4407 affects phpMyFAQ versions before 3.1.9. The vulnerability is a reflected XSS in the admin area (e.g., action parameter in phpmyfaq/admin/index.php), caused by unsanitized user input being echoed into HTML attributes. Multiple sources (NVD entry, Exploit-DB PoC for 3.1.7, OSV/CIRCL s...
CVE-2022-4408
phpMyFAQ is affected up to version 3.1.8 with a stored Cross-site Scripting (XSS) vulnerability. The issue arises from handling user input stored in the database (GitHub repo thorsten/phpmyfaq). Impact is XSS in affected users’ browsers. Remediation: upgrade to version 3.1.9 or later; as a workar...
Authentication Bypass
thorsten/phpmyfaq is vulnerable to authentication bypass. The vulnerability exists due to lack of restrictions in the password change function which allows an attacker to successfully update the password by changing one character...
Cross-Site Scripting (XSS)
thorsten/phpmyfaq is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to missing quoting for search terms which allows an attacker to inject arbitrary html and script code into the web site...
CVE-2022-3766
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8...
CVE-2022-3766 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8...
CVE-2022-3765
CVE-2022-3765 is a stored Cross-site Scripting (XSS) vulnerability affecting phpMyFAQ versions prior to 3.1.8 (repository: thorsten/phpmyfaq). The incident is described across multiple sources as storing unvalidated user input that can be delivered to other users, with the impacted component bein...
CVE-2022-3765 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8...
CVE-2022-3766
CVE-2022-3766 affects phpMyFAQ versions prior to 3.1.8. The nuclei template and related sources describe a reflected Cross-Site Scripting (XSS) vulnerability in the search functionality, where user input is not properly sanitized, allowing injected JavaScript to execute in other users’ browsers. ...