phpMyFAQ 3.2.5
Approved changes feed: RSS · Atom
cpe:2.3:a:phpmyfaq:phpmyfaq:3.2.5:*:*:*:*:*:*:*part: a version: 3.2.5 update: *
| Vendor | Phpmyfaq (36d5951f-3344-59d3-87f2-c1fb92487bb6) |
|---|---|
| Product | Phpmyfaq (6f356a4b-5559-5157-b7be-8fda97b04dcf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/phpmyfaq/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543174 |
pkg:docker/phpmyfaq/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543175 |
pkg:github/thorsten/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543177 |
pkg:rpm/opensuse/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543178 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-29196 |
vulnerable | 2026-06-08 06:33:28.951431 |
phpMyFAQ Path Traversal in Attachments
LOW (3.8)
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.
Published: 2024-03-26T03:01:36.890Z
Updated: 2024-08-05T16:29:28.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29179 |
vulnerable | 2026-06-08 06:33:28.914764 |
phpMyFAQ Stored Cross-site Scripting at File Attachments
MEDIUM (4.3)
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks.
Published: 2024-03-25T20:27:55.083Z
Updated: 2025-04-10T18:29:53.455Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28108 |
vulnerable | 2026-06-08 06:33:26.477668 |
phpMyFAQ Stored HTML Injection at contentLink
MEDIUM (4.7)
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6.
Published: 2024-03-25T18:52:19.325Z
Updated: 2024-08-02T00:48:48.813Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28107 |
vulnerable | 2026-06-08 06:33:26.477259 |
phpMyFAQ SQL injections at insertentry & saveentry
HIGH (8.8)
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.
Published: 2024-03-25T18:47:12.328Z
Updated: 2025-04-10T18:30:21.506Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28106 |
vulnerable | 2026-06-08 06:33:26.476794 |
phpMyFAQ Stored XSS at FAQ News Content
MEDIUM (4.3)
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.
Published: 2024-03-25T18:41:58.260Z
Updated: 2024-08-02T00:48:49.468Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28105 |
vulnerable | 2026-06-08 06:33:26.476342 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27300 |
vulnerable | 2026-06-08 06:31:28.458279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27299 |
vulnerable | 2026-06-08 06:31:28.457738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.