Phpfaber maintains a small portfolio of web-based content management and utility applications, including TopSites, a content management system, and Urlinn, which operate in the PHP ecosystem. The recurring vulnerability pattern centers on web-layer input-handling and code-generation weaknesses—including code injection, cross-site scripting, and related input-validation flaws—characteristic of server-side PHP applications where user-supplied data reaches dangerous execution contexts. Vulnerabilities affecting this vendor frequently acquire public exploit code, making timely patching important for deployed instances; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpfaber over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-2155HIGH Directory traversal vulnerability in template.php in in phpFaber TopSites 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the modify parameter in a template | Apr 19, 2007 | 7.8 | 29 | NO | YES |
CVE-2007-5754MEDIUM PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the dir_ws paramet | Oct 31, 2007 | 6.8 | 27 | NO | YES |
CVE-2009-4382MEDIUM Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter. | Dec 22, 2009 | 4.3 | 21 | NO | YES |
CVE-2006-5626MEDIUM Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inj | Oct 31, 2006 | 4.3 | 21 | NO | YES |
CVE-2006-3770HIGH Multiple SQL injection vulnerabilities in index.php in phpFaber TopSites 2.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) i_cat or (2) method | Jul 24, 2006 | 7.5 | 19 | NO | NO |
Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter. | Apr 20, 2006 | 2.6 | 18 | NO | YES |
CVE-2006-3902MEDIUM Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites 2.0.9 allows remote attackers to inject arbitrary web script or HTML via the i_cat parameter. NOTE: the | Jul 27, 2006 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpfaber.
Media articles that mention a CVE ID that affects a product developed by Phpfaber — matched by CVE ID, not by vendor name.