Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
110 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Recommended action: Upgrade to 3.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Recommended action: Upgrade to 3.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Recommended action: Upgrade to 3.1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Recommended action: Upgrade to 3.1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.
Recommended action: Upgrade to 3.2.0-beta.2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In thorsten/phpmyfaq prior to 3.1.14, when admins create a FAQ News, they can pass xss to the "text of the record" section.
Recommended action: Upgrade to 3.1.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.14 is vulnerable to a stored cross-site scripting attack perpetuated by an actor logged in as admin.
Recommended action: Upgrade to 3.1.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
Recommended action: Upgrade to 3.2.0-beta (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
Recommended action: Upgrade to 3.2.0-beta (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to version 3.1.13.
Recommended action: Upgrade to 3.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to version 3.1.13.
Recommended action: Upgrade to 3.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to other users such as the administrator. Once the attacker has control of the other user's email address, they can request to remove the user from the system, leading to a loss of data and access.
Recommended action: Upgrade to 3.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies.
Recommended action: Upgrade to 3.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to authentication bypass by capture-relay that allows unlimited comments to be sent. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ site while generating an HTML Export. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to cross-site scripting (XSS) because it fails to sanitize user input in the stopword parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the category field name parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 allows users with edit-only permissions to add and delete categories and add FAQs. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the updatecategory parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ comment username parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the artlang parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting (XSS) because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the adminlog. This has been fixed in 3.1.12.
Recommended action: Upgrade to 3.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.