phpmyfaq/phpmyfaq vulnerabilities (Packagist)
47 vulnerabilities.
-
phpmyfaq/phpmyfaqPackagist phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion 8.5 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ's two-factor authentication login bypasses the password factor 8.1 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission 8.2 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints 6.9 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function 5.1 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) 6.5 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing 2.7 Low -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update 8.8 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Authentication Bypass via Empty API Token 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Insecure Direct Object Reference in User Password API 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint 8.8 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha 9.3 Critical -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter 7.0 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields 7.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint 9.3 Critical -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints 5.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig 8.2 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure 5.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer 5.1 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass 5.1 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Missing Authorization in Tag Deletion Endpoint 5.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check 7.1 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering 8.3 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() 6.1 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController 8.7 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor 5.4 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Public API endpoints expose emails and invisible questions 5.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user 6.5 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) 6.5 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ 3.1.12 CSV Injection via User Profile Export 6.2 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality 7.2 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Vulnerable to Stored HTML Injection at FAQ 5.2 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Stored Cross-site Scripting at File Attachments 4.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Path Traversal in Attachments 3.8 Low -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Stored HTML Injection at contentLink 4.7 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ SQL injections at insertentry & saveentry 8.8 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Stored XSS at FAQ News Content 4.3 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ's File Upload Bypass at Category Image Leads to RCE 7.2 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ Stored XSS at user email 5.5 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ SQL Injection at "Save News" 8.8 High -
phpmyfaq/phpmyfaqPackagist phpMyFAQ vulnerable to stored XSS on attachments filename 6.5 Medium -
phpmyfaq/phpmyfaqPackagist phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes 6.5 Medium -
phpmyfaq/phpmyfaqPackagist User Removal Page Allows Spoofing Of User Details 5.7 Medium -
phpmyfaq/phpmyfaqPackagist Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq 7.2 High