Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

phpMyFAQ can let attackers run malicious scripts

CVE-2009-4780 · published 16 years ago
Summary

Older versions of phpMyFAQ let a remote user insert harmful code into web pages by sending specially crafted requests. This could let attackers steal data or hijack user sessions when visitors view the compromised pages. Upgrade phpMyFAQ to version 2.5.5 or later to close the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phpmyfaq phpmyfaq <= 2.5.4
0.60
0.65
0.70
0.80
0.80a
0.85
0.86
0.87
0.90
0.95
0.666
94 more version ranges
cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap actio...
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Apr 2010
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-4780 · NVD
Track software like this
Free during beta