Php Heaven maintains PHPMyChat, a PHP-based web application with a compact but persistent vulnerability profile rooted in foundational web-application security weaknesses. The exposure recurs across authentication handling, path traversal, cross-site scripting, and SQL injection—classes typical of legacy web applications where input validation and access controls demand rigorous remediation. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Php Heaven over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-2716HIGH Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, | Dec 31, 2004 | 7.5 | 34 | NO | YES |
CVE-2004-2715HIGH edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false. | Dec 31, 2004 | 7.5 | 30 | NO | YES |
CVE-2008-1504MEDIUM Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter. NOTE: t | Mar 25, 2008 | 4.3 | 21 | NO | YES |
CVE-2007-6297MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML via the (1) LIMIT parameter to chat/deluser.ph | Dec 10, 2007 | 4.3 | 21 | NO | YES |
CVE-2005-3991MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to (1) start_page.css | Dec 4, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-1619MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote attackers to inject | May 16, 2005 | 4.3 | 21 | NO | YES |
CVE-2004-2718MEDIUM PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request. | Dec 31, 2004 | 4.3 | 21 | NO | YES |
CVE-2006-5088HIGH PHP remote file inclusion vulnerability in connected_users.lib.php3 in phpHeaven phpMyChat 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath param | Sep 29, 2006 | 7.5 | 19 | NO | NO |
CVE-2001-1357HIGH Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown consequences, possibly related to user spoof | Feb 7, 2001 | 7.5 | 19 | NO | NO |
CVE-2001-1358HIGH Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library file in the L (localization) parameter. | Feb 7, 2001 | 7.2 | 19 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Php Heaven.
Media articles that mention a CVE ID that affects a product developed by Php Heaven — matched by CVE ID, not by vendor name.