CVE-2023-1886

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

VendorProductVersions
thorstenthorsten/phpmyfaq>= unspecified, < 3.1.12

References

Timeline

Published
Apr 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-18874.3Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-18888.8The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due CVE-2023-18896.5The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is dCVE-2023-18906.1The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices aCVE-2023-18916.1The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notCVE-2023-18929.6Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.CVE-2023-18936.1The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a CVE-2023-18945.3A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to speciCVE-2023-18959.6The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpointCVE-2023-18977.5Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could alloCVE-2023-18987.5Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve dCVE-2023-18997.5Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information b
CVE-2023-1886: Critical severity, CVSS 9.8 | Vulnix