Loading...
Skip to main content
GeekWala

CVE-2023-53929 — Vulnerability in thorsten/phpmyfaq — CVE Details

MEDIUM

phpMyFAQ contains a CSV injection vulnerability

Published December 18, 2025Updated February 3, 2026Source: osv

Summary

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.

Advisory Timeline

  • First published December 18, 2025 (298 days ago).
  • Last revised February 3, 2026 — 47 days after initial publication.

Affected Packages (2)

Affects 1 ecosystem: packagist (2).

PackageEcosystemAffectedFixed In
thorsten/phpmyfaq
packagist
2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+100 more)Range-based data available
phpmyfaq/phpmyfaq
packagist
2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+100 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-53929?
phpMyFAQ contains a CSV injection vulnerability This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2023-53929?
CVE-2023-53929 affects thorsten/phpmyfaq and phpmyfaq/phpmyfaq. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-53929 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-x2v3-9p22-w3x6

Related CVEs

  • CVE-2026-46364
    CRITICAL

    phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

  • CVE-2026-45010
    CRITICAL

    phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

  • CVE-2026-56737
    HIGH

    phpMyFAQ's two-factor authentication login bypasses the password factor

  • CVE-2026-56396
    HIGH

    phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

  • CVE-2026-35676
    HIGH

    phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

  • CVE-2026-57995
    HIGH

    phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

  • CVE-2026-56736
    HIGH

    phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

  • CVE-2026-32629
    MEDIUM

    phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies