phpfox records

10 published records for vendor phpfox.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 5
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

10 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2023-46817No exploit	An issue was discovered in phpFox before 4.8.14.phpfox · phpfox · CWE-502 Pre-auth Deserialization	Critical9.8	—	1.8%	Nov 3, 2023
30Monitor	CVE-2013-5120Proof of concept	SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender]phpfox · phpfox · CWE-89 pre-auth RCE SQL injection	High7.5	—	1.1%	Aug 14, 2013
30Monitor	CVE-2013-5121Proof of concept	SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_byphpfox · phpfox · CWE-89 pre-auth RCE SQL injection	High7.5	—	1.1%	Aug 14, 2013
28Monitor	CVE-2022-34560No exploit	A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload phpfox · phpfox · CWE-79 pre-auth RCE XSS	High7.1	—	0.3%	Apr 22, 2024
27Monitor	CVE-2009-0969No exploit	Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack thephpfox · phpfox · CWE-352 Pre-auth CSRF	Medium6.8	—	0.6%	Mar 19, 2009
24Monitor	CVE-2022-34562No exploit	A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload phpfox · phpfox · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.3%	Apr 22, 2024
23Monitor	CVE-2013-7196Proof of concept	static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment onphpfox · phpfox · CWE-264	Medium5.5	—	2.4%	Apr 18, 2014
22Monitor	CVE-2013-7195No exploit	PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request thphpfox · phpfox · CWE-264	Medium5.5	—	1.2%	Apr 18, 2014
17Monitor	CVE-2022-34561No exploit	A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload phpfox · phpfox · CWE-79 pre-auth RCE XSS Denial of service	Medium4.3	—	0.4%	Apr 22, 2024
16Monitor	CVE-2006-2631No exploit	phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfox_user parameter.phpfox · phpfox	Medium4.0	—	1.2%	May 27, 2006

CVE-2023-46817
40Plan
An issue was discovered in phpFox before 4.8.14.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Deserialization
phpfox · phpfoxNov 3, 2023
CVE-2013-5120
30Monitor
SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender]
HighCVSS 7.5Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
phpfox · phpfoxAug 14, 2013
CVE-2013-5121
30Monitor
SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_by
HighCVSS 7.5Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
phpfox · phpfoxAug 14, 2013
CVE-2022-34560
28Monitor
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- XSS
phpfox · phpfoxApr 22, 2024
CVE-2009-0969
27Monitor
Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the
MediumCVSS 6.8No exploitEPSS 1%
- Pre-auth
- CSRF
phpfox · phpfoxMar 19, 2009
CVE-2022-34562
24Monitor
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
phpfox · phpfoxApr 22, 2024
CVE-2013-7196
23Monitor
static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on
MediumCVSS 5.5Proof of conceptEPSS 2%
phpfox · phpfoxApr 18, 2014
CVE-2013-7195
22Monitor
PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request th
MediumCVSS 5.5No exploitEPSS 1%
phpfox · phpfoxApr 18, 2014
CVE-2022-34561
17Monitor
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
MediumCVSS 4.3No exploitEPSS 0%
phpfox · phpfoxApr 22, 2024
CVE-2006-2631
16Monitor
phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfox_user parameter.
MediumCVSS 4.0No exploitEPSS 1%
phpfox · phpfoxMay 27, 2006