Fascript's vulnerability profile centers on a narrow portfolio of web applications and media-handling products, which despite modest volume occupy a position among more prominent vendors in the landscape. Vulnerabilities affecting the product line skew toward critical severity and demonstrate a strong, recurring tendency to acquire public exploit code, consistent with the appeal of web-facing applications and input-handling flaws to the security research and penetration-testing communities. The exposure recurs across products such as FAName, FAMP3, and FAPhoto through weakness classes including SQL injection, cross-site scripting, and sensitive information disclosure that are characteristic of application-layer input validation and output-encoding issues. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fascript over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-3652CRITICAL SQL injection vulnerability in class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this | Jul 9, 2008 | 9.8 | 29 | NO | NO |
CVE-2008-5766HIGH SQL injection vulnerability in download.php in Farsi Script Faupload allows remote attackers to execute arbitrary SQL commands via the id parameter. | Dec 30, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-0325HIGH SQL injection vulnerability in show.php in FaScript FaPersian Petition allows remote attackers to execute arbitrary SQL commands via the id parameter. | Jan 17, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-0326HIGH SQL injection vulnerability in class/show.php in FaScript FaPersianHack 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to show.php. | Jan 17, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-0327HIGH SQL injection vulnerability in show.php in FaScript FaMp3 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Jan 17, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-0328HIGH SQL injection vulnerability in page.php in FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Jan 17, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-1714MEDIUM SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter. | Apr 9, 2008 | 6.8 | 26 | NO | YES |
CVE-2007-3653MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) d | Jul 9, 2008 | 4.3 | 21 | NO | YES |
CVE-2007-3651MEDIUM class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) sequence in the id parameter, which reve | Jul 9, 2008 | 5.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fascript.
Media articles that mention a CVE ID that affects a product developed by Fascript — matched by CVE ID, not by vendor name.