TI-2023-25288 CVE-2023-46817 · GHSA-23qj-5qgc-98rc
An issue was discovered in phpFox before 4.8.14.
Priority HIGH 82
An issue was discovered in phpFox before 4.8.14.
Phpfox
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Phpfox records in CISA KEVNo Phpfox vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Phpfox · all components
TI-2013-04445 CVE-2013-5121 · GHSA-27jc-4vc3-969q
SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to…
Priority LOW 35
SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_by] parameter to user/browse/view_/.
TI-2013-04444 CVE-2013-5120 · GHSA-q64p-wfcw-h6w9
SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to…
Priority LOW 35
SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender] parameter to user/browse/view_/.
TI-2022-15412 CVE-2022-34560 · GHSA-2fgw-hpx5-xjx3
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute…
Priority LOW 31
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the History parameter.
TI-2009-00923 CVE-2009-0969 · GHSA-p26j-vgpm-gv3f
Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in…
Priority LOW 31
Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the authentication of administrators for requests that change the email address via…
TI-2013-05886 CVE-2013-7196 · GHSA-6g65-24hq-98xf
static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to…
Priority LOW 29
static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified val[item_id] parameter for…
TI-2022-15414 CVE-2022-34562 · GHSA-5cgr-mmx8-w3fg
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute…
Priority LOW 27
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the status box.
TI-2013-05885 CVE-2013-7195 · GHSA-rqxj-58fq-78fr
PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me"…
Priority LOW 27
PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication.
TI-2006-02540 CVE-2006-2631 · GHSA-qj9f-rx22-hq52
phpFoX allows remote authenticated users to modify arbitrary accounts via a modified…
Priority LOW 21
phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfox_user parameter.
TI-2022-15413 CVE-2022-34561 · GHSA-qrpq-f2gq-8mj5
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute…
Priority LOW 20
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the video description parameter.