Количество 3
Количество 3
CVE-2026-75918
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
GHSA-hccc-74hg-j43v
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
BDU:2026-12006
Уязвимость метода userTracking() класса UserSession файла src/phpMyFAQ/User/UserSession.php веб-приложения phpMyFAQ, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-75918 phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts. | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| GHSA-hccc-74hg-j43v phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts. | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
 | BDU:2026-12006 Уязвимость метода userTracking() класса UserSession файла src/phpMyFAQ/User/UserSession.php веб-приложения phpMyFAQ, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 8.8 | 0% Низкий | около 2 месяцев назад |
Уязвимостей на страницу