Loading...
Skip to main content
GeekWala

CVE-2023-0788 — Code Injection in thorsten/phpmyfaq — CVE Details

CRITICAL

Code Injection in thorsten/phpmyfaq

Published February 12, 2023Updated March 21, 2025Source: osv

Summary

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

Advisory Timeline

  • First published February 12, 2023 (1338 days ago).
  • Last revised March 21, 2025 — 768 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update thorsten/phpmyfaq to 3.1.11 or later
composer require "thorsten/phpmyfaq:^3.1.11"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
thorsten/phpmyfaq
packagist
2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+98 more)3.1.11

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-0788?
Code Injection in thorsten/phpmyfaq This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2023-0788?
CVE-2023-0788 affects thorsten/phpmyfaq. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-0788 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-r6cw-356h-mvwg

Related CVEs

  • CVE-2026-46364
    CRITICAL

    phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

  • CVE-2022-3754
    CRITICAL

    phpMyFAQ contains Weak Password Requirements

  • CVE-2023-0789
    CRITICAL

    Command Injection in thorsten/phpmyfaq

  • CVE-2026-45010
    CRITICAL

    phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

  • CVE-2026-56737
    HIGH

    phpMyFAQ's two-factor authentication login bypasses the password factor

  • CVE-2026-56396
    HIGH

    phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

  • CVE-2026-35676
    HIGH

    phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

  • CVE-2026-32629
    MEDIUM

    phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies