English
Français
Light
Dark
System

Alert System

Stay informed at all times
Create an account Open a free account Login Manage your alerts

phpMyFAQ 1.1.4a

CPE Details

phpMyFAQ 1.1.4a
phpmyfaq
phpmyfaq
1.1.4a
2008-12-09 18:17 +00:00
2012-10-23 18:58 +00:00
CPE NVD

Alerte pour un CPE

Stay informed of any changes for a specific CPE.
Alert management

CPE Name: cpe:2.3:a:phpmyfaq:phpmyfaq:1.1.4a:*:*:*:*:*:*:*

Informations

Vendor

phpmyfaq

Product

phpmyfaq

Version

1.1.4a

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-24574 2024-02-05 20:57 +00:00 phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
6.5
MEDIUM
CVE-2024-22208 2024-02-05 20:44 +00:00 phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.
6.5
MEDIUM
CVE-2024-22202 2024-02-05 19:39 +00:00 phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn't allow changing the form details, an attacker can utilize a proxy to intercept this request and submit other data. Upon submitting this form, an email is sent to the administrator informing them that this user wants to delete their account. An administrator has no way of telling the difference between the actual user wishing to delete their account or the attacker issuing this for an account they do not control. This issue has been patched in version 3.2.5.
6.5
MEDIUM
CVE-2023-6890 2023-12-16 08:57 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
5.4
MEDIUM
CVE-2023-6889 2023-12-16 08:57 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
5.4
MEDIUM
CVE-2023-5866 2023-10-31 00:00 +00:00 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
5.7
MEDIUM
CVE-2023-5867 2023-10-31 00:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
5.4
MEDIUM
CVE-2023-5865 2023-10-31 00:00 +00:00 Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
9.8
CRITICAL
CVE-2023-5864 2023-10-31 00:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
4.8
MEDIUM
CVE-2023-5863 2023-10-31 00:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
6.1
MEDIUM
CVE-2023-5320 2023-09-30 00:00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
6.1
MEDIUM
CVE-2023-5317 2023-09-30 00:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
5.4
MEDIUM
CVE-2023-5316 2023-09-30 00:00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
6.1
MEDIUM
CVE-2023-5319 2023-09-30 00:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
5.4
MEDIUM
CVE-2023-5227 2023-09-30 00:00 +00:00 Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
9.8
CRITICAL
CVE-2023-4007 2023-07-31 00:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
5.4
MEDIUM
CVE-2023-4006 2023-07-31 00:00 +00:00 Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
9.8
CRITICAL
CVE-2023-3469 2023-06-30 00:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
4.8
MEDIUM
CVE-2023-2998 2023-05-30 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
6.1
MEDIUM
CVE-2023-2999 2023-05-30 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
6.1
MEDIUM
CVE-2023-2752 2023-05-16 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
5.4
MEDIUM
CVE-2023-2753 2023-05-16 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
5.4
MEDIUM
CVE-2023-2427 2023-05-04 22:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
4.8
MEDIUM
CVE-2023-2550 2023-05-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
4.8
MEDIUM
CVE-2023-2428 2023-04-29 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
5.4
MEDIUM
CVE-2023-2429 2023-04-29 22:00 +00:00 Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
9.8
CRITICAL
CVE-2023-1875 2023-04-21 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1756 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1757 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1758 2023-04-04 22:00 +00:00 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1878 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1879 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1880 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.1
MEDIUM
CVE-2023-1882 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1883 2023-04-04 22:00 +00:00 Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1884 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.1
MEDIUM
CVE-2023-1885 2023-04-04 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.3
MEDIUM
CVE-2023-1886 2023-04-04 22:00 +00:00 Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
9.8
CRITICAL
CVE-2023-1887 2023-04-04 22:00 +00:00 Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.3
MEDIUM
CVE-2023-1753 2023-03-30 22:00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
9.8
CRITICAL
CVE-2023-1754 2023-03-30 22:00 +00:00 Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.7
MEDIUM
CVE-2023-1755 2023-03-30 22:00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
MEDIUM
CVE-2023-1759 2023-03-30 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.8
MEDIUM
CVE-2023-1760 2023-03-30 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.8
MEDIUM
CVE-2023-1761 2023-03-30 22:00 +00:00 Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.3
MEDIUM
CVE-2023-1762 2023-03-30 22:00 +00:00 Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
8.8
HIGH
CVE-2023-0880 2023-02-16 23:00 +00:00 Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
HIGH
CVE-2023-0786 2023-02-11 23:00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.4
HIGH
CVE-2023-0787 2023-02-11 23:00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.1
HIGH
CVE-2023-0788 2023-02-11 23:00 +00:00 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
9.8
CRITICAL
CVE-2023-0789 2023-02-11 23:00 +00:00 Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
9.8
CRITICAL
CVE-2023-0790 2023-02-11 23:00 +00:00 Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.8
HIGH
CVE-2023-0791 2023-02-11 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
HIGH
CVE-2023-0792 2023-02-11 23:00 +00:00 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
6.5
MEDIUM
CVE-2023-0793 2023-02-11 23:00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.8
HIGH
CVE-2023-0794 2023-02-11 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
HIGH
CVE-2023-0306 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
MEDIUM
CVE-2023-0307 2023-01-14 23:00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
9.8
CRITICAL
CVE-2023-0308 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
MEDIUM
CVE-2023-0309 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
MEDIUM
CVE-2023-0310 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
MEDIUM
CVE-2023-0311 2023-01-14 23:00 +00:00 Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
9.8
CRITICAL
CVE-2023-0312 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
6.1
MEDIUM
CVE-2023-0313 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
MEDIUM
CVE-2023-0314 2023-01-14 23:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
6.1
MEDIUM
CVE-2022-4407 2022-12-10 23:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
6.1
MEDIUM
CVE-2022-4408 2022-12-10 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
5.4
MEDIUM
CVE-2022-4409 2022-12-10 23:00 +00:00 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
7.5
HIGH
CVE-2022-3765 2022-10-30 23:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
5.4
MEDIUM
CVE-2022-3766 2022-10-30 23:00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
6.1
MEDIUM
CVE-2022-3754 2022-10-28 22:00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
9.8
CRITICAL
CVE-2022-3608 2022-10-18 22:00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
8.4
HIGH
CVE-2009-4780 2022-10-03 14:24 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
4.3
CVE-2009-4040 2022-10-03 14:24 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the search page.
4.3
CVE-2017-15732 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
8.8
HIGH
CVE-2017-15728 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
4.8
MEDIUM
CVE-2017-15729 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
8.8
HIGH
CVE-2017-15731 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
8.8
HIGH
CVE-2017-15733 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
8.8
HIGH
CVE-2017-15734 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
8.8
HIGH
CVE-2017-15809 2022-10-03 14:23 +00:00 In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
6.1
MEDIUM
CVE-2017-15735 2022-10-03 14:23 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
8.8
HIGH
CVE-2017-15808 2022-10-03 14:23 +00:00 In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
8.8
HIGH
CVE-2017-11187 2022-10-03 14:23 +00:00 phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
9.8
CRITICAL
CVE-2018-16650 2018-09-07 03:00 +00:00 phpMyFAQ before 2.9.11 allows CSRF.
8.8
HIGH
CVE-2018-16651 2018-09-07 03:00 +00:00 The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
7.2
HIGH
CVE-2014-6045 2018-08-28 15:00 +00:00 SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.
7.2
HIGH
CVE-2014-6046 2018-08-28 15:00 +00:00 Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.
8.8
HIGH
CVE-2014-6047 2018-08-28 15:00 +00:00 phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.
5.3
MEDIUM
CVE-2014-6048 2018-08-28 15:00 +00:00 phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
5.3
MEDIUM
CVE-2014-6049 2018-08-28 15:00 +00:00 phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
2.7
LOW
CVE-2014-6050 2018-08-28 15:00 +00:00 phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
5.3
MEDIUM
CVE-2017-15727 2017-10-21 20:00 +00:00 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
5.4
MEDIUM
CVE-2017-15730 2017-10-21 20:00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
8.8
HIGH
CVE-2017-14618 2017-09-20 19:00 +00:00 Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
4.8
MEDIUM
CVE-2017-14619 2017-09-20 19:00 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
6.1
MEDIUM
CVE-2017-7579 2017-04-07 14:00 +00:00 inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
6.1
MEDIUM
CVE-2014-0813 2014-02-14 15:00 +00:00 Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.
6.8
CVE-2014-0814 2014-02-14 15:00 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3
CVE-2010-4821 2012-10-22 21:00 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
4.3
CVE-2007-1032 2007-02-21 10:00 +00:00 Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files on the server."
6.8
CVE-2006-6912 2007-01-09 17:00 +00:00 SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.
7.5
CVE-2006-6913 2007-01-09 17:00 +00:00 Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors.
7.5

More information
Click on the button to the left (OFF), to authorize the inscription of cookie improving the functionalities of the site. Click on the button to the left (Accept all), to unauthorize the inscription of cookie improving the functionalities of the site.