Phpmyfaq
by PhpMyAdmin
Source repositories
CVEs (170)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-11187 | Cri | 0.64 | 9.8 | 0.01 | Jul 12, 2017 | phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. | ||
| CVE-2017-15808 | Hig | 0.60 | 8.8 | 0.01 | Oct 23, 2017 | In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. | ||
| CVE-2017-15730 | Hig | 0.60 | 8.8 | 0.02 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. | ||
| CVE-2026-56396 | Hig | 0.57 | 8.8 | 0.00 | Jun 21, 2026 | phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights… | ||
| CVE-2026-46364 | Cri | 0.57 | 9.8 | 0.02 | May 15, 2026 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the… | ||
| CVE-2023-53929 | Hig | 0.57 | 8.8 | 0.01 | Dec 17, 2025 | phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user… | ||
| CVE-2023-5865 | Cri | 0.57 | 9.8 | 0.01 | Oct 31, 2023 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. | ||
| CVE-2023-5227 | Cri | 0.57 | 9.8 | 0.01 | Sep 30, 2023 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. | ||
| CVE-2023-4006 | Cri | 0.57 | 9.8 | 0.01 | Jul 31, 2023 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. | ||
| CVE-2023-2429 | Cri | 0.57 | 9.8 | 0.01 | Apr 30, 2023 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||
| CVE-2023-0311 | Cri | 0.57 | 9.8 | 0.01 | Jan 15, 2023 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. | ||
| CVE-2023-0307 | Cri | 0.57 | 9.8 | 0.01 | Jan 15, 2023 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. | ||
| CVE-2022-3754 | Cri | 0.57 | 9.8 | 0.01 | Oct 29, 2022 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. | ||
| CVE-2018-16650 | Hig | 0.57 | 8.8 | 0.01 | Sep 7, 2018 | phpMyFAQ before 2.9.11 allows CSRF. | ||
| CVE-2017-15733 | Hig | 0.57 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php. | ||
| CVE-2017-15732 | Hig | 0.57 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php. | ||
| CVE-2017-15731 | Hig | 0.57 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php. | ||
| CVE-2017-15729 | Hig | 0.57 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary. | ||
| CVE-2014-6046 | Hig | 0.53 | 8.8 | 0.02 | Aug 28, 2018 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open… | ||
| CVE-2017-15735 | Hig | 0.53 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. |
- risk 0.64cvss 9.8epss 0.01
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
- risk 0.60cvss 8.8epss 0.01
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
- risk 0.60cvss 8.8epss 0.02
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
- risk 0.57cvss 8.8epss 0.00
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights…
- risk 0.57cvss 9.8epss 0.02
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the…
- risk 0.57cvss 8.8epss 0.01
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user…
- risk 0.57cvss 9.8epss 0.01
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- risk 0.57cvss 9.8epss 0.01
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- risk 0.57cvss 9.8epss 0.01
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
- risk 0.57cvss 9.8epss 0.01
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- risk 0.57cvss 9.8epss 0.01
Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- risk 0.57cvss 8.8epss 0.01
phpMyFAQ before 2.9.11 allows CSRF.
- risk 0.57cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
- risk 0.57cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
- risk 0.57cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
- risk 0.57cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
- risk 0.53cvss 8.8epss 0.02
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open…
- risk 0.53cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
Page 1 of 9