Description
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated by using LANGCODE to reference the user tracking data file.
Remediation
References
Related Vulnerabilities
WordPress Plugin RSS Feed Widget Cross-Site Scripting (2.8.0)
WordPress 5.4.x Multiple Vulnerabilities (5.4 - 5.4.2)
Atlassian Jira Incorrect Authorization Vulnerability (CVE-2021-43948)
MongoDb Reachable Assertion Vulnerability (CVE-2026-13058)
WordPress Plugin WP SVG Icons Cross-Site Request Forgery (3.2.1)