CVE-2023-53929
High
Description
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPhpmyfaq
PublishedDec 17, 2025
First seenDec 17, 2025
Weakness typeCWE-1236CWE-1236
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyfaq phpmyfaq | 3.1.12 | — |
| thorsten/phpmyfaqPackagist | v ≤ 3.1.12 | — |
| phpmyfaq/phpmyfaqPackagist | v ≤ 3.1.12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.