CVE-2023-0311

CRITICAL

Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS0.9%
Percentile60th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-287: Improper Authentication

Software does not prove or insufficiently proves that the user is who they claim to be.

Related Attack Patterns (CAPEC)
CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
via CWE-287
CAPEC-633 Token Impersonation
via CWE-287
CAPEC-650 Upload a Web Shell to a Web Server
via CWE-287
CAPEC-194 Fake the Source of Data
via CWE-287
CAPEC-593 Session Hijacking
via CWE-287
Show all 10

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Improper authentication vulnerability in phpMyFAQ versions prior to 3.1.10 allows attackers to bypass authentication and gain unauthorized access to the application.

BSID: BS-2023-GLOBAL-341574-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-0311?
Improper authentication vulnerability in phpMyFAQ versions prior to 3.1.10 allows attackers to bypass authentication and gain unauthorized access to the application.
What is the CVSS score for CVE-2023-0311?
CVE-2023-0311 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2023-0311 actively exploited?
No confirmed active exploitation of CVE-2023-0311 as of 2026-05-30.
How do I remediate CVE-2023-0311?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-0311?
CVE-2023-0311 affects Phpmyfaq Phpmyfaq.
Vulnerability Details
CVE IDCVE-2023-0311
BSIDBS-2023-GLOBAL-341574-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-01-15
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Improper Authentication
SourceNVD
Official Description

Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted requests to the application, which does not properly validate user credentials, leading to unauthorized access.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Phpmyfaq Phpmyfaq < 3.1.10
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1369 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash66881c863ace86e3949e2392ec1ac59e5e5f3df5cde83915affb25dc698c21ce946be1821382d389e18e553e343d7f6a1194b9311a189f40925e28633eea15e8
Related CVEs affecting Phpmyfaq
CVE-2023-0307 9.8 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. CVE-2023-0788 9.8 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. CVE-2017-11187 9.8 phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try... CVE-2022-3754 9.8 Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. CVE-2023-0789 9.8 Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
View all Phpmyfaq CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →