CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2006-6912 – phpMyFAQ 1.6.7 - SQL Injection / Command Execution
https://notcve.org/view.php?id=CVE-2006-6912
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter. Vulnerabilidad de inyección de SQL en el phpMyFAQ 1.6.7 y versiones anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección mediante vectores sin especificar. • https://www.exploit-db.com/exploits/3393 http://secunia.com/advisories/23651 http://www.phpmyfaq.de/advisory_2006-12-15.php http://www.securityfocus.com/bid/21944 http://www.vupen.com/english/advisories/2007/0077 https://exchange.xforce.ibmcloud.com/vulnerabilities/32802 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 1CVE-2005-3734
https://notcve.org/view.php?id=CVE-2005-3734
Cross-site scripting (XSS) vulnerability in the "add content" page in phpMyFAQ 1.5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) thema, (2) username, and (3) usermail parameters. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página "add content" de phpMyFAQ 1.5.3 y anteriores permite a atacantes remotos inyectar 'script' web arbitrario mediante los parámetros (1) thema, (2) username, y (3) usermail. • http://secunia.com/advisories/17649 http://securityreason.com/securityalert/196 http://www.osvdb.org/20989 http://www.phpmyfaq.de/advisory_2005-11-18.php http://www.securityfocus.com/archive/1/417219/30/0/threaded http://www.securityfocus.com/bid/15504 http://www.trapkit.de/advisories/TKADV2005-11-004.txt http://www.vupen.com/english/advisories/2005/2505 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2005-3050
https://notcve.org/view.php?id=CVE-2005-3050
PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message. • http://marc.info/?l=bugtraq&m=112749230124091&w=2 http://rgod.altervista.org/phpmyfuck151.html •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2005-3047
https://notcve.org/view.php?id=CVE-2005-3047
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PMF_CONF[version] parameter to footer.php or (2) PMF_LANG[metaLanguage] to header.php. • http://marc.info/?l=bugtraq&m=112749230124091&w=2 http://rgod.altervista.org/phpmyfuck151.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 1%CPEs: 1EXPL: 1CVE-2005-3048 – phpMyFAQ 1.5.1 - 'User-Agent' Remote Shell Injection
https://notcve.org/view.php?id=CVE-2005-3048
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated by using LANGCODE to reference the user tracking data file. • https://www.exploit-db.com/exploits/1226 http://marc.info/?l=bugtraq&m=112749230124091&w=2 http://rgod.altervista.org/phpmyfuck151.html http://www.osvdb.org/19672 •