CVE-2023-53929
No fix known EPSS <1%CVSS 8.8
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
Products: phpmyfaq
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | no fix |
| Packagist | thorsten/phpmyfaq | no fix |