CVE-2023-53929: phpMyFAQ contains a CSV injection vulnerability

December 18, 2025 (updated January 2, 2026)

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like ‘calc|a!z|’ to trigger code execution when an administrator exports user data as a CSV file.

References

github.com/advisories/GHSA-x2v3-9p22-w3x6
github.com/thorsten/phpMyFAQ
nvd.nist.gov/vuln/detail/CVE-2023-53929
www.exploit-db.com/exploits/51399
www.phpmyfaq.de/
www.vulncheck.com/advisories/phpmyfaq-csv-injection-via-user-profile-export

Code Behaviors & Features

Detect and mitigate CVE-2023-53929 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →