Description The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. Remediation References CVE-2018-16651 Related Vulnerabilities Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-59681) MediaWiki Observable Discrepancy Vulnerability (CVE-2022-41765) WordPress Plugin WPFront Scroll Top Cross-Site Scripting (2.0.5.07184) WordPress Plugin GeoDirectory-WordPress Business Directory and Classified Ads Listings Cross-Site Scripting (2.2.21) WordPress Plugin Extend WordPress-Various Shortcodes & Widgets TimThumb Arbitrary File Upload (2.1.01) Severity High Classification CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Tags Missing Update Known Vulnerabilities CWE-1236 CVE-2018-16651