thorsten/phpmyfaq vulnerabilities (Packagist)
112 vulnerabilities.
-
thorsten/phpmyfaqPackagist phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion 8.5 High -
thorsten/phpmyfaqPackagist phpMyFAQ's two-factor authentication login bypasses the password factor 8.1 High -
thorsten/phpmyfaqPackagist phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission 8.2 High -
thorsten/phpmyfaqPackagist phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration 5.4 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints 6.9 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function 5.1 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions 8.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() 8.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) 6.5 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing 2.7 Low -
thorsten/phpmyfaqPackagist phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update 8.8 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Authentication Bypass via Empty API Token 8.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Insecure Direct Object Reference in User Password API 8.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint 8.8 High -
thorsten/phpmyfaqPackagist phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha 9.3 Critical -
thorsten/phpmyfaqPackagist phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter 7.0 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass 8.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields 7.7 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint 9.3 Critical -
thorsten/phpmyfaqPackagist phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints 5.3 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig 8.2 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure 5.3 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer 5.1 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass 5.1 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Missing Authorization in Tag Deletion Endpoint 5.3 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check 7.1 High -
thorsten/phpmyfaqPackagist phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering 8.3 High -
thorsten/phpmyfaqPackagist phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation 5.4 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure 6.9 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor 5.4 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint 7.5 High -
thorsten/phpmyfaqPackagist phpMyFAQ: Public API endpoints expose emails and invisible questions 5.3 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user 6.5 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) 6.5 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ has unauthenticated config backup download via /api/setup/backup 7.5 High -
thorsten/phpmyfaqPackagist phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw 5.4 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ 3.1.12 CSV Injection via User Profile Export 6.2 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality 7.2 High -
thorsten/phpmyfaqPackagist phpMyFAQ duplicate email registration allows multiple accounts with the same email 8.1 High -
thorsten/phpmyfaqPackagist phpMyFAQ Vulnerable to Stored HTML Injection at FAQ 5.2 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames 4.9 Medium -
thorsten/phpmyfaqPackagist phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available 8.6 High -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq 5.4 Medium -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq 5.4 Medium -
thorsten/phpmyfaqPackagist Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq 6.3 Medium -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq 4.6 Medium -
thorsten/phpmyfaqPackagist Insufficient Session Expiration in thorsten/phpmyfaq 7.6 High -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq 7.4 High -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq 7.4 High -
thorsten/phpmyfaqPackagist Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq 9.0 Critical - Show olderLoading…