GCVE - cpe:2.3:a:ciprianmp:phpmychat-plus:1.98:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ciprianmp:phpmychat-plus:1.98:*:*:*:*:*:*:*

part: a version: 1.98 update: *

Vendor	Ciprianmp (`251d1548-8794-5c50-8e47-f1a026c22272`)
Product	Phpmychat Plus (`a28a5621-1e98-5d56-93da-128a0993631a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/phpmychat-plus/phpmychat-plus`	purl2cpe	2026-06-01 10:13:30.563077
`pkg:sourceforge/phpmychat`	purl2cpe	2026-06-01 10:13:30.563080

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-9265`	vulnerable	2026-06-08 05:27:21.056926	Details available CRITICAL (9.3) phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username. Published: 2020-02-18T17:22:38.000Z Updated: 2024-08-04T10:26:14.448Z Open on db.gcve.eu Reference links https://github.com/J3rryBl4nks/PHPMyChatPlus/blob/master/SQLi.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-37151`	vulnerable	2026-06-08 05:25:50.251227	phpMyChat Plus 1.98 'deluser.php' SQL Injection HIGH (8.2) phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to extract sensitive database information by crafting malicious payloads in the username field. Published: 2026-02-05T15:25:22.320Z Updated: 2026-07-15T01:24:28.498Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48066 http://ciprianmp.com/latest/ https://www.vulncheck.com/advisories/phpmychat-plus-deluserphp-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-19908`	vulnerable	2026-06-08 05:13:23.991944	Details available phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable. Published: 2019-12-20T12:47:14.000Z Updated: 2024-08-05T02:32:09.897Z Open on db.gcve.eu Reference links http://ciprianmp.com/ https://sourceforge.net/projects/phpmychat/ https://cinzinga.github.io/CVE-2019-19908/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.