CVE-2023-53929— phpMyFAQ 3.1.12 CSV Injection via User Profile Export
Quick assessment
Affected
Phpmyfaq phpMyFAQ
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
phpMyFAQ是Thorsten Rinne个人开发者的一个多语言、完全由数据库驱动的常见问题解答系统。 phpMyFAQ 3.1.12版本存在安全漏洞，该漏洞源于经过身份验证的用户可在其个人资料名称中注入恶意公式，可能导致CSV注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-53929
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
phpMyFAQ 3.1.12 CSV Injection via User Profile Export
Source: CVE Program / CVE List V5
Vulnerability Description
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1236
Source: CVE Program / CVE List V5
Vulnerability Title
phpMyFAQ 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
phpMyFAQ是Thorsten Rinne个人开发者的一个多语言、完全由数据库驱动的常见问题解答系统。 phpMyFAQ 3.1.12版本存在安全漏洞，该漏洞源于经过身份验证的用户可在其个人资料名称中注入恶意公式，可能导致CSV注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-53929
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-53929
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2023-53929 (1)
Other References for CVE-2023-53929 (2)
-
https://www.phpmyfaq.de/ product
-
https://www.vulncheck.com/advisories/phpmyfaq-csv-injection-via-user-profile-export third-party-advisory
IV. Related Vulnerabilities
Same product: phpMyFAQ
-
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Al -
CVE-2026-56738
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped -
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the pass -
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity -
CVE-2026-85593
phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
Same vendor: Phpmyfaq
-
CVE-2026-57996
phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard -
CVE-2026-57994
phpMyFAQ - Information Disclosure of Inactive FAQ Content vi -
CVE-2026-57961
phpMyFAQ - Authenticated Path Traversal in PDF Export via co -
CVE-2026-57995
phpMyFAQ - Privilege Escalation via Missing Self-Rights Cons -
CVE-2026-56396
phpMyFAQ - Privilege Escalation via Missing Authorization in
Same weakness: CWE-1236
-
CVE-2026-100564
OpenClaw before 2026.8.1 CSV Formula Injection via Attendanc -
CVE-2026-100563
OpenClaw before 2026.8.1 CSV Formula Injection via Session L -
CVE-2026-89246
WWBN AVideo CSV Formula Injection via myComments.download.ph -
CVE-2026-86745
Snipe-IT before 8.7.0 CSV Formula Injection via Location-Sco -
CVE-2026-86742
Snipe-IT before 8.7.0 CSV Formula Injection via Asset Accept
V. Comments for CVE-2023-53929
No comments yet