Phpheaven maintains a narrowly scoped portfolio centered on the PHPMyChat instant-messaging application and its commercial variant, which have been targets for web-based vulnerabilities over time. The vendor's exposure recurs through input-handling weaknesses including cross-site scripting and path traversal, characteristic of web applications handling user-supplied data and file references, and frequently acquires public exploit tooling. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpheaven over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-2716HIGH Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, | Dec 31, 2004 | 7.5 | 34 | NO | YES |
CVE-2004-2715HIGH edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false. | Dec 31, 2004 | 7.5 | 30 | NO | YES |
CVE-2008-1504MEDIUM Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter. NOTE: t | Mar 25, 2008 | 4.3 | 21 | NO | YES |
CVE-2007-6297MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML via the (1) LIMIT parameter to chat/deluser.ph | Dec 10, 2007 | 4.3 | 21 | NO | YES |
CVE-2005-3991MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to (1) start_page.css | Dec 4, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-1619MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote attackers to inject | May 16, 2005 | 4.3 | 21 | NO | YES |
CVE-2004-2718MEDIUM PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request. | Dec 31, 2004 | 4.3 | 21 | NO | YES |
CVE-2006-5088HIGH PHP remote file inclusion vulnerability in connected_users.lib.php3 in phpHeaven phpMyChat 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath param | Sep 29, 2006 | 7.5 | 19 | NO | NO |
CVE-2001-1357HIGH Multiple vulnerabilities in phpMyChat before 0.14.5 exist in (1) input.php3, (2) handle_inputH.php3, or (3) index.lib.php3 with unknown consequences, possibly related to user spoof | Feb 7, 2001 | 7.5 | 19 | NO | NO |
CVE-2001-1358HIGH Vulnerabilities in phpMyChat before 0.14.4 allow local and possibly remote attackers to gain privileges by specifying an alternate library file in the L (localization) parameter. | Feb 7, 2001 | 7.2 | 19 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpheaven.
Media articles that mention a CVE ID that affects a product developed by Phpheaven — matched by CVE ID, not by vendor name.