Phpmyfaq
Page 2 of 2 — Phpmyfaq CVEs from a corpus of 160, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0314 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0313 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0312 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0310 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0309 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0308 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0307 | Critical | 9.8 | 2023-01-15 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0306 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4408 | Medium | 5.4 | 2022-12-11 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4407 | Medium | 6.1 | 2022-12-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-3766 | Medium | 6.1 | 2022-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-3765 | Medium | 5.4 | 2022-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-3754 | Critical | 9.8 | 2022-10-29 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-3608 | High | 8.4 | 2022-10-19 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha. |
CVE-2018-16651 | High | 7.2 | 2018-09-07 | The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. |
CVE-2018-16650 | High | 8.8 | 2018-09-07 | phpMyFAQ before 2.9.11 allows CSRF. |
CVE-2014-6050 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request. |
CVE-2014-6049 | Low | 2.7 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. |
CVE-2014-6048 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. |
CVE-2014-6047 | Medium | 5.3 | 2018-08-28 | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment… |
CVE-2014-6046 | High | 8.8 | 2018-08-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users f… |
CVE-2014-6045 | High | 7.2 | 2018-08-28 | SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors… |
CVE-2017-15809 | Medium | 6.1 | 2017-10-23 | In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag. |
CVE-2017-15808 | High | 8.8 | 2017-10-23 | In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. |
CVE-2017-15735 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. |
CVE-2017-15734 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. |
CVE-2017-15733 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php. |
CVE-2017-15732 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php. |
CVE-2017-15731 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php. |
CVE-2017-15730 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. |
CVE-2017-15729 | High | 8.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary. |
CVE-2017-15728 | Medium | 4.8 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords. |
CVE-2017-15727 | Medium | 5.4 | 2017-10-22 | In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment. |
CVE-2017-14619 | Medium | 6.1 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" f… |
CVE-2017-14618 | Medium | 4.8 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Qu… |
CVE-2017-11187 | Critical | 9.8 | 2017-07-12 | phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. |
CVE-2017-7579 | Medium | 6.1 | 2017-04-07 | inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field. |
CVE-2014-0814 | | 2014-02-14 | Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2014-0813 | | 2014-02-14 | Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests t… | |
CVE-2010-4821 | | 2012-10-22 | Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. | |
CVE-2011-4825 | | 2011-12-15 | Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2… | |
CVE-2011-3783 | | 2011-09-24 | phpMyFAQ 2.6.13 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error me… | |
CVE-2010-4558 | | 2010-12-17 | phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the ge… | |
CVE-2009-4780 | | 2010-04-21 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1)… | |
CVE-2009-4040 | | 2009-11-20 | Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to… | |
CVE-2007-1032 | | 2007-02-21 | Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files o… | |
CVE-2006-6913 | | 2006-12-31 | Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors. | |
CVE-2006-6912 | | 2006-12-31 | SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userf… | |
CVE-2005-3734 | | 2005-11-22 | Cross-site scripting (XSS) vulnerability in the "add content" page in phpMyFAQ 1.5.3 and earlier allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2005-3050 | | 2005-09-24 | PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message. | |
CVE-2005-3049 | | 2005-09-24 | PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtai… | |
CVE-2005-3048 | | 2005-09-24 | Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot d… | |
CVE-2005-3047 | | 2005-09-24 | Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PMF_CONF[versio… | |
CVE-2005-3046 | | 2005-09-24 | SQL injection vulnerability in password.php in PhpMyFaq 1.5.1 allows remote attackers to modify SQL queries and gain administrator privileges via the user fiel… | |
CVE-2005-0702 | | 2005-03-07 | SQL injection vulnerability in phpMyFAQ 1.4 and 1.5 allows remote attackers to add FAQ records to the database via the username field in forum messages. | |
CVE-2004-2257 | Medium | 5.3 | 2004-12-31 | phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request. |
CVE-2004-2256 | | 2004-12-31 | Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP files, via .. sequenc… | |
CVE-2004-2255 | | 2004-12-31 | Directory traversal vulnerability in phpMyFAQ 1.3.12 allows remote attackers to read arbitrary files, and possibly execute local PHP files, via the action vari… |