U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/a:phpmyfaq:phpmyfaq:0.90
There are 103 matching records.
Displaying matches 61 through 80.
Vuln ID Summary CVSS Severity
CVE-2023-0310

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Published: January 15, 2023; 5:15:10 PM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2023-0309

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Published: January 15, 2023; 5:15:10 PM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2023-0308

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Published: January 15, 2023; 5:15:10 PM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2023-0307

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Published: January 15, 2023; 5:15:10 PM -0500 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2023-0306

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Published: January 15, 2023; 5:15:10 PM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2022-4409

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Published: December 11, 2022; 10:15:10 AM -0500 		V3.1: 7.5 HIGH
 V2.0:(not available)
CVE-2022-4408

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Published: December 11, 2022; 10:15:10 AM -0500 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2022-4407

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

Published: December 11, 2022; 10:15:10 AM -0500 		V3.1: 6.1 MEDIUM
 V2.0:(not available)
CVE-2022-3766

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Published: October 31, 2022; 7:15:10 AM -0400 		V3.1: 6.1 MEDIUM
 V2.0:(not available)
CVE-2022-3765

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Published: October 31, 2022; 7:15:10 AM -0400 		V3.1: 5.4 MEDIUM
 V2.0:(not available)
CVE-2022-3754

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Published: October 29, 2022; 9:15:09 AM -0400 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2022-3608

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.

Published: October 19, 2022; 9:15:08 AM -0400 		V3.1: 8.4 HIGH
 V2.0:(not available)
CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.

Published: September 07, 2018; 1:29:00 AM -0400 		V3.0: 7.2 HIGH
 V2.0: 9.0 HIGH
CVE-2018-16650

phpMyFAQ before 2.9.11 allows CSRF.

Published: September 07, 2018; 1:29:00 AM -0400 		V3.0: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2014-6050

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.

Published: August 28, 2018; 1:29:01 PM -0400 		V3.0: 5.3 MEDIUM
 V2.0: 5.0 MEDIUM
CVE-2014-6049

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter.

Published: August 28, 2018; 1:29:01 PM -0400 		V3.0: 2.7 LOW
 V2.0: 5.5 MEDIUM
CVE-2014-6048

phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.

Published: August 28, 2018; 1:29:01 PM -0400 		V3.0: 5.3 MEDIUM
 V2.0: 5.0 MEDIUM
CVE-2014-6047

phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks.

Published: August 28, 2018; 1:29:01 PM -0400 		V3.0: 5.3 MEDIUM
 V2.0: 5.0 MEDIUM
CVE-2014-6046

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.

Published: August 28, 2018; 1:29:00 PM -0400 		V3.0: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2014-6045

SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function.

Published: August 28, 2018; 1:29:00 PM -0400 		V3.0: 7.2 HIGH
 V2.0: 6.5 MEDIUM