phpMyFAQ 2.7.4

CPE Details

phpMyFAQ 2.7.4
phpmyfaq
phpmyfaq
2.7.4
2014-02-18
15h49 +00:00
2014-02-20
22h53 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:phpmyfaq:phpmyfaq:2.7.4:*:*:*:*:*:*:*

Informations

Vendor

phpmyfaq

Product

phpmyfaq

Version

2.7.4

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-24574 2024-02-05 20h57 +00:00 phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
6.5
Moyen
CVE-2024-22208 2024-02-05 20h44 +00:00 phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. Any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputation damages. This issue has been patched in version 3.2.5.
6.5
Moyen
CVE-2024-22202 2024-02-05 19h39 +00:00 phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn't allow changing the form details, an attacker can utilize a proxy to intercept this request and submit other data. Upon submitting this form, an email is sent to the administrator informing them that this user wants to delete their account. An administrator has no way of telling the difference between the actual user wishing to delete their account or the attacker issuing this for an account they do not control. This issue has been patched in version 3.2.5.
6.5
Moyen
CVE-2023-6890 2023-12-16 08h57 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
5.4
Moyen
CVE-2023-6889 2023-12-16 08h57 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
5.4
Moyen
CVE-2023-5866 2023-10-31 00h00 +00:00 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
5.7
Moyen
CVE-2023-5867 2023-10-31 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
5.4
Moyen
CVE-2023-5865 2023-10-31 00h00 +00:00 Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
9.8
Critique
CVE-2023-5864 2023-10-31 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
4.8
Moyen
CVE-2023-5863 2023-10-31 00h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
6.1
Moyen
CVE-2023-5320 2023-09-30 00h00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
6.1
Moyen
CVE-2023-5317 2023-09-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
5.4
Moyen
CVE-2023-5316 2023-09-30 00h00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
6.1
Moyen
CVE-2023-5319 2023-09-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
5.4
Moyen
CVE-2023-5227 2023-09-30 00h00 +00:00 Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
9.8
Critique
CVE-2023-4007 2023-07-31 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
5.4
Moyen
CVE-2023-4006 2023-07-31 00h00 +00:00 Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
9.8
Critique
CVE-2023-3469 2023-06-30 00h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
4.8
Moyen
CVE-2023-2998 2023-05-30 22h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
6.1
Moyen
CVE-2023-2999 2023-05-30 22h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
6.1
Moyen
CVE-2023-2753 2023-05-17 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
5.4
Moyen
CVE-2023-2752 2023-05-16 22h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
5.4
Moyen
CVE-2023-2427 2023-05-05 00h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
4.8
Moyen
CVE-2023-2550 2023-05-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
4.8
Moyen
CVE-2023-2428 2023-04-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
5.4
Moyen
CVE-2023-2429 2023-04-30 00h00 +00:00 Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
9.8
Critique
CVE-2023-1875 2023-04-22 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1756 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1757 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1758 2023-04-05 00h00 +00:00 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1878 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1879 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1880 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.1
Moyen
CVE-2023-1882 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1883 2023-04-05 00h00 +00:00 Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1884 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.1
Moyen
CVE-2023-1885 2023-04-05 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.3
Moyen
CVE-2023-1886 2023-04-05 00h00 +00:00 Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
9.8
Critique
CVE-2023-1887 2023-04-05 00h00 +00:00 Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.3
Moyen
CVE-2023-1753 2023-03-31 00h00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
9.8
Critique
CVE-2023-1754 2023-03-31 00h00 +00:00 Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.7
Moyen
CVE-2023-1755 2023-03-31 00h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
5.4
Moyen
CVE-2023-1759 2023-03-31 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.8
Moyen
CVE-2023-1760 2023-03-31 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
4.8
Moyen
CVE-2023-1761 2023-03-31 00h00 +00:00 Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
6.3
Moyen
CVE-2023-1762 2023-03-31 00h00 +00:00 Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
8.8
Haute
CVE-2023-0880 2023-02-17 00h00 +00:00 Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
Haute
CVE-2023-0786 2023-02-11 23h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.4
Haute
CVE-2023-0787 2023-02-11 23h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.1
Haute
CVE-2023-0788 2023-02-11 23h00 +00:00 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
9.8
Critique
CVE-2023-0789 2023-02-11 23h00 +00:00 Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
9.8
Critique
CVE-2023-0790 2023-02-11 23h00 +00:00 Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.8
Haute
CVE-2023-0791 2023-02-11 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
Haute
CVE-2023-0792 2023-02-11 23h00 +00:00 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
6.5
Moyen
CVE-2023-0793 2023-02-11 23h00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.8
Haute
CVE-2023-0794 2023-02-11 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
8.3
Haute
CVE-2023-0306 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
Moyen
CVE-2023-0307 2023-01-14 23h00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
9.8
Critique
CVE-2023-0308 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
Moyen
CVE-2023-0309 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
Moyen
CVE-2023-0310 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
Moyen
CVE-2023-0311 2023-01-14 23h00 +00:00 Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
9.8
Critique
CVE-2023-0312 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
6.1
Moyen
CVE-2023-0313 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
5.4
Moyen
CVE-2023-0314 2023-01-14 23h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
6.1
Moyen
CVE-2022-4407 2022-12-10 23h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
6.1
Moyen
CVE-2022-4408 2022-12-10 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
5.4
Moyen
CVE-2022-4409 2022-12-10 23h00 +00:00 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
7.5
Haute
CVE-2022-3765 2022-10-30 23h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
5.4
Moyen
CVE-2022-3766 2022-10-30 23h00 +00:00 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
6.1
Moyen
CVE-2022-3754 2022-10-28 22h00 +00:00 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
9.8
Critique
CVE-2022-3608 2022-10-18 22h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
8.4
Haute
CVE-2018-16650 2018-09-07 03h00 +00:00 phpMyFAQ before 2.9.11 allows CSRF.
8.8
Haute
CVE-2018-16651 2018-09-07 03h00 +00:00 The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
7.2
Haute
CVE-2014-6045 2018-08-28 15h00 +00:00 SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.
7.2
Haute
CVE-2014-6046 2018-08-28 15h00 +00:00 Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.
8.8
Haute
CVE-2014-6047 2018-08-28 15h00 +00:00 phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.
5.3
Moyen
CVE-2014-6048 2018-08-28 15h00 +00:00 phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
5.3
Moyen
CVE-2014-6049 2018-08-28 15h00 +00:00 phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.
2.7
Bas
CVE-2014-6050 2018-08-28 15h00 +00:00 phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
5.3
Moyen
CVE-2017-15808 2017-10-23 17h00 +00:00 In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
8.8
Haute
CVE-2017-15809 2017-10-23 17h00 +00:00 In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
6.1
Moyen
CVE-2017-15728 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
4.8
Moyen
CVE-2017-15729 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
8.8
Haute
CVE-2017-15731 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
8.8
Haute
CVE-2017-15732 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
8.8
Haute
CVE-2017-15733 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
8.8
Haute
CVE-2017-15734 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
8.8
Haute
CVE-2017-15735 2017-10-21 22h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
8.8
Haute
CVE-2017-15727 2017-10-21 20h00 +00:00 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
5.4
Moyen
CVE-2017-15730 2017-10-21 20h00 +00:00 In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
8.8
Haute
CVE-2017-14618 2017-09-20 19h00 +00:00 Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
4.8
Moyen
CVE-2017-14619 2017-09-20 19h00 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.
6.1
Moyen
CVE-2017-11187 2017-07-12 14h00 +00:00 phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
9.8
Critique
CVE-2017-7579 2017-04-07 14h00 +00:00 inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
6.1
Moyen
CVE-2014-0813 2014-02-14 15h00 +00:00 Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings.
6.8
CVE-2014-0814 2014-02-14 15h00 +00:00 Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4.3