Vulnerabilities > Phpmyfaq > High

DATE CVE VULNERABILITY TITLE RISK
2023-02-12 CVE-2023-0790 Uncaught Exception vulnerability in PHPmyfaq
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
network
low complexity
phpmyfaq CWE-248
8.8
2023-02-12 CVE-2023-0793 Weak Password Requirements vulnerability in PHPmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
network
low complexity
phpmyfaq CWE-521
8.8
2022-12-11 CVE-2022-4409 Missing Encryption of Sensitive Data vulnerability in PHPmyfaq
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
network
low complexity
phpmyfaq CWE-311
7.5
2022-10-19 CVE-2022-3608 Cross-site Scripting vulnerability in PHPmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
network
low complexity
phpmyfaq CWE-79
8.4
2011-12-15 CVE-2011-4825 Code Injection vulnerability in multiple products
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
network
low complexity
phpletter phpmyfaq tinymce CWE-94
7.5
2010-12-17 CVE-2010-4558 Code Injection vulnerability in PHPmyfaq 2.6.11/2.6.12
phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in inc/Faq.php, which allows remote attackers to execute arbitrary PHP code.
network
low complexity
phpmyfaq CWE-94
7.5
2006-12-31 CVE-2006-6913 Security Bypass vulnerability in phpMyFAQ
Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors.
network
low complexity
phpmyfaq
7.5
2006-12-31 CVE-2006-6912 SQL Injection vulnerability in PHPmyfaq
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.
network
low complexity
phpmyfaq CWE-89
7.5