Phpmyfaq Phpmyfaq vulnerabilities

• phpmyfaq phpMyFAQ before 4.1.7 Missing Authorization via child resources CVE-2026-76215 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge CVE-2026-76214 9.1 CriticalAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle CVE-2026-76213 9.1 CriticalAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL CVE-2026-76212 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Information Disclosure via Admin API CVE-2026-76211 5.3 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export CVE-2026-76210 7.1 HighAugust 19, 2026
• phpmyfaq phpMyFAQ before v4.1.6 Registration Bypass via API CVE-2026-76209 5.3 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP CVE-2026-76208 8.8 HighAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie CVE-2026-76207 8.6 HighAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Information Disclosure via PDF Export CVE-2026-76206 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 SQL Injection via Glossary CVE-2026-76205 8.6 HighAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP CVE-2026-75920 6.0 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Authentication Bypass via Setup API CVE-2026-75919 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File CVE-2026-75918 8.7 HighAugust 19, 2026
• phpmyfaq phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint CVE-2026-57996 8.7 HighJuly 15, 2026
• phpmyfaq phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints CVE-2026-57994 Fix available 6.9 MediumJuly 10, 2026
• phpmyfaq phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function CVE-2026-57961 Fix available 5.1 MediumJuly 10, 2026
• phpmyfaq phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions CVE-2026-57995 Fix available 8.7 HighJune 30, 2026
• phpmyfaq phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() CVE-2026-56396 Fix available 8.7 HighJune 21, 2026
• phpmyfaq phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation CVE-2026-34974 Fix available 5.4 MediumApril 1, 2026
• phpmyfaq phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure CVE-2026-34973 Fix available 6.9 MediumApril 1, 2026
• phpmyfaq phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() CVE-2026-34729 Fix available 6.1 MediumApril 1, 2026
• phpmyfaq phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController CVE-2026-34728 Fix available 8.7 HighApril 1, 2026
• phpmyfaq phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor CVE-2026-32629 Fix available 5.4 MediumMarch 31, 2026
• phpmyfaq phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint CVE-2026-27836 Fix available 7.5 HighFebruary 27, 2026
• phpmyfaq phpMyFAQ: Public API endpoints expose emails and invisible questions CVE-2026-24422 Fix available 5.3 MediumJanuary 23, 2026
• phpmyfaq phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user CVE-2026-24421 Public exploitFix available 6.5 MediumJanuary 23, 2026
• phpmyfaq phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) CVE-2026-24420 Fix available 6.5 MediumJanuary 23, 2026
• phpmyfaq phpMyFAQ has unauthenticated config backup download via /api/setup/backup CVE-2025-69200 Fix available 7.5 HighDecember 29, 2025
• phpmyfaq phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw CVE-2025-68951 Fix available 5.4 MediumDecember 29, 2025
• phpmyfaq phpMyFAQ 3.1.12 CSV Injection via User Profile Export CVE-2023-53929 6.2 MediumDecember 17, 2025
• phpmyfaq phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality CVE-2025-62519 Fix available 7.2 HighNovember 17, 2025
• phpmyfaq phpMyFAQ duplicate email registration allows multiple accounts with the same email CVE-2025-59943 Fix available 8.1 HighOctober 3, 2025
• phpmyfaq phpMyFAQ Vulnerable to Stored HTML Injection at FAQ CVE-2024-56199 5.2 MediumJanuary 2, 2025
• phpmyfaq phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames CVE-2024-55889 Public exploitFix available 4.9 MediumDecember 13, 2024
• phpmyfaq phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available CVE-2024-54141 Fix available 8.6 HighDecember 6, 2024
• phpmyfaq phpMyFAQ Stored Cross-site Scripting at File Attachments CVE-2024-29179 Fix available 4.3 MediumMarch 25, 2024
• phpmyfaq phpMyFAQ Path Traversal in Attachments CVE-2024-29196 Fix available 3.8 LowMarch 25, 2024
• phpmyfaq phpMyFAQ Stored HTML Injection at contentLink CVE-2024-28108 Fix available 4.7 MediumMarch 25, 2024
• phpmyfaq phpMyFAQ SQL injections at insertentry & saveentry CVE-2024-28107 Fix available 8.8 HighMarch 25, 2024
• phpmyfaq phpMyFAQ Stored XSS at FAQ News Content CVE-2024-28106 Fix available 4.3 MediumMarch 25, 2024
• phpmyfaq phpMyFAQ's File Upload Bypass at Category Image Leads to RCE CVE-2024-28105 Fix available 7.2 HighMarch 25, 2024
• phpmyfaq phpMyFAQ Stored XSS at user email CVE-2024-27300 Fix available 5.5 MediumMarch 25, 2024
• phpmyfaq phpMyFAQ SQL Injection at "Save News" CVE-2024-27299 Fix available 8.8 HighMarch 25, 2024
• phpmyfaq phpMyFAQ vulnerable to stored XSS on attachments filename CVE-2024-24574 Fix available 6.5 MediumFebruary 5, 2024
• phpmyfaq phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes CVE-2024-22208 Fix available 6.5 MediumFebruary 5, 2024
• phpmyfaq User Removal Page Allows Spoofing Of User Details CVE-2024-22202 Fix available 5.7 MediumFebruary 5, 2024
• phpmyfaq, thorsten thorsten/phpmyfaq +1 more Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq CVE-2023-6890 Fix available 5.4 MediumDecember 16, 2023
• phpmyfaq, thorsten thorsten/phpmyfaq +1 more Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq CVE-2023-6889 Fix available 5.4 MediumDecember 16, 2023
• phpmyfaq, thorsten thorsten/phpmyfaq +1 more Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq CVE-2023-5866 Fix available 6.3 MediumOctober 31, 2023
• Show olderLoading…