Skip to content
Thorsten vulnerabilities
Newest
-
thorsten phpmyfaq
phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
CVE-2026-116183
8.7 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
CVE-2026-116182
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CVE-2026-111911
9.3 Critical
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
CVE-2026-111910
7.1 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
CVE-2026-111909
7.2 High
-
thorsten phpmyfaq
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
CVE-2026-111908
8.7 High
-
thorsten phpmyfaq
phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
CVE-2026-111907
7.1 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
CVE-2026-111906
7.1 High
-
thorsten phpmyfaq
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
CVE-2026-111905
7.0 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
CVE-2026-111904
6.9 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
CVE-2026-111903
5.1 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
CVE-2026-111902
6.9 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVE-2026-111901
8.7 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
CVE-2026-111900
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
CVE-2026-111898
7.7 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
CVE-2026-111897
7.1 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
CVE-2026-111896
5.1 Medium
-
thorsten phpmyfaq
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username
CVE-2026-111895
7.6 High
-
thorsten phpmyfaq
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
CVE-2026-111894
5.1 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
CVE-2026-111893
8.5 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
CVE-2026-111892
6.9 Medium
-
thorsten phpmyfaq
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API
CVE-2026-111891
7.0 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights
CVE-2026-111890
7.0 High
-
thorsten phpmyfaq
phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
CVE-2026-111889
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
CVE-2026-111888
5.1 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
CVE-2026-111887
6.9 Medium
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
CVE-2026-111886
7.1 High
-
thorsten phpmyfaq
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
CVE-2026-111885
7.0 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
CVE-2026-111884
8.7 High
-
thorsten phpmyfaq
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks
CVE-2026-111882
8.6 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
CVE-2026-109573
9.2 Critical
-
thorsten phpmyfaq
phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
CVE-2026-108851
4.8 Medium
-
thorsten phpmyfaq
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
CVE-2026-56738
Fix available
8.5 High
-
thorsten phpmyfaq
phpMyFAQ's two-factor authentication login bypasses the password factor
CVE-2026-56737
Fix available
8.1 High
-
thorsten phpmyfaq
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
CVE-2026-56736
Fix available
8.2 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
CVE-2026-85593
5.1 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 Authorization Bypass via question/create
CVE-2026-85592
6.3 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
CVE-2026-85591
7.1 High
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
CVE-2026-85590
7.1 High
-
thorsten phpmyfaq
phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
CVE-2026-85589
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
CVE-2026-85588
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
CVE-2026-85587
5.3 Medium
-
thorsten phpmyfaq
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
CVE-2026-85586
6.9 Medium
-
phpmyfaq
phpMyFAQ before 4.1.7 Missing Authorization via child resources
CVE-2026-76215
6.9 Medium
-
phpmyfaq
phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
CVE-2026-76214
9.1 Critical
-
phpmyfaq
phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
CVE-2026-76213
9.1 Critical
-
phpmyfaq
phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
CVE-2026-76212
6.9 Medium
-
phpmyfaq
phpMyFAQ before 4.1.7 Information Disclosure via Admin API
CVE-2026-76211
5.3 Medium
-
phpmyfaq
phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
CVE-2026-76210
7.1 High
-
phpmyfaq
phpMyFAQ before v4.1.6 Registration Bypass via API
CVE-2026-76209
5.3 Medium
- Show olderLoading…