{"items":[{"id":"NVI-00008027","kind":"vulnerability","title":"Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"withdrawn","identifiers":["GHSA-p9wc-4pjv-rg82"],"plain_summary":"GitHub lists this reviewed advisory for thorsten/phpmyfaq, phpmyfaq/phpmyfaq. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-59ad8a6f9f49db4a7e23819491a226a0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.1.2 for thorsten/phpmyfaq. Confirm the publisher’s latest guidance.","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.1.2 for phpmyfaq/phpmyfaq. Confirm the publisher’s latest guidance.","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-09T00:02:14.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-59ad8a6f9f49db4a7e23819491a226a0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-59ad8a6f9f49db4a7e23819491a226a0","url":"https://github.com/advisories/GHSA-p9wc-4pjv-rg82","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p9wc-4pjv-rg82","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T20:58:31.464Z"},{"id":"sr-f2c1a69b336ea4e4577aa44323fb23bb","url":"https://github.com/advisories/GHSA-p9wc-4pjv-rg82","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-p9wc-4pjv-rg82","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.989Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-59ad8a6f9f49db4a7e23819491a226a0"],"technology":"thorsten/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["< 4.1.2"]},{"certainty":"source_listed","source_ids":["sr-59ad8a6f9f49db4a7e23819491a226a0"],"technology":"phpmyfaq/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["< 4.1.2"]},{"certainty":"source_listed","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"technology":"thorsten/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.1.2"]},{"certainty":"source_listed","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"technology":"phpmyfaq/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.1.2"]}],"null_published_at":"2026-11-08T15:11:47.498Z","source_updated_at":"2026-06-09T00:02:14.000Z","source_disclosed_at":"2026-05-15T21:31:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:30.989Z"},{"id":"NVI-00008027","kind":"vulnerability","title":"Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"withdrawn","identifiers":["GHSA-p9wc-4pjv-rg82"],"plain_summary":"OSV carries this publisher advisory for thorsten/phpmyfaq, phpmyfaq/phpmyfaq. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 4.1.2 for thorsten/phpmyfaq. Confirm the publisher’s latest guidance.","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.1.2 for phpmyfaq/phpmyfaq. Confirm the publisher’s latest guidance.","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-f2c1a69b336ea4e4577aa44323fb23bb","url":"https://github.com/advisories/GHSA-p9wc-4pjv-rg82","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-p9wc-4pjv-rg82","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.989Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"technology":"thorsten/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.1.2"]},{"certainty":"source_listed","source_ids":["sr-f2c1a69b336ea4e4577aa44323fb23bb"],"technology":"phpmyfaq/phpmyfaq","known_exclusions":[],"conditions_summary":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pm8c-3qq3-72w7. This link is maintained to preserve external references.\n\n### Original Description\nphpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.1.2"]}],"null_published_at":"2026-10-31T22:13:22.826Z","source_updated_at":"2026-09-10T03:51:06.666Z","source_disclosed_at":"2026-05-15T21:31:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.989Z"}],"next_cursor":null,"snapshot_revision":"42594"}