Thorsten Phpmyfaq vulnerabilities

• thorsten phpmyfaq phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID CVE-2026-116183 8.7 HighOctober 25, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching CVE-2026-116182 5.3 MediumOctober 25, 2026
• thorsten phpmyfaq phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection CVE-2026-111911 9.3 CriticalOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads CVE-2026-111910 7.1 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API CVE-2026-111909 7.2 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API CVE-2026-111908 8.7 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database CVE-2026-111907 7.1 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations CVE-2026-111906 7.1 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data CVE-2026-111905 7.0 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API CVE-2026-111904 6.9 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass CVE-2026-111903 5.1 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API CVE-2026-111902 6.9 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination CVE-2026-111901 8.7 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php CVE-2026-111900 5.3 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking CVE-2026-111898 7.7 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints CVE-2026-111897 7.1 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass CVE-2026-111896 5.1 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username CVE-2026-111895 7.6 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI CVE-2026-111894 5.1 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API CVE-2026-111893 8.5 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints CVE-2026-111892 6.9 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API CVE-2026-111891 7.0 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights CVE-2026-111890 7.0 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard CVE-2026-111889 5.3 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API CVE-2026-111888 5.1 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint CVE-2026-111887 6.9 MediumOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint CVE-2026-111886 7.1 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API CVE-2026-111885 7.0 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover CVE-2026-111884 8.7 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks CVE-2026-111882 8.6 HighOctober 17, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint CVE-2026-109573 9.2 CriticalOctober 12, 2026
• thorsten phpmyfaq phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool CVE-2026-108851 4.8 MediumOctober 11, 2026
• thorsten phpmyfaq phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion CVE-2026-56738 Fix available 8.5 HighSeptember 24, 2026
• thorsten phpmyfaq phpMyFAQ's two-factor authentication login bypasses the password factor CVE-2026-56737 Fix available 8.1 HighSeptember 24, 2026
• thorsten phpmyfaq phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission CVE-2026-56736 Fix available 8.2 HighSeptember 24, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode CVE-2026-85593 5.1 MediumSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 Authorization Bypass via question/create CVE-2026-85592 6.3 MediumSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change CVE-2026-85591 7.1 HighSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable CVE-2026-85590 7.1 HighSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API CVE-2026-85589 5.3 MediumSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export CVE-2026-85588 5.3 MediumSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages CVE-2026-85587 5.3 MediumSeptember 4, 2026
• thorsten phpmyfaq phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter CVE-2026-85586 6.9 MediumSeptember 4, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Missing Authorization via child resources CVE-2026-76215 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge CVE-2026-76214 9.1 CriticalAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle CVE-2026-76213 9.1 CriticalAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL CVE-2026-76212 6.9 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before 4.1.7 Information Disclosure via Admin API CVE-2026-76211 5.3 MediumAugust 19, 2026
• phpmyfaq phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export CVE-2026-76210 7.1 HighAugust 19, 2026
• phpmyfaq phpMyFAQ before v4.1.6 Registration Bypass via API CVE-2026-76209 5.3 MediumAugust 19, 2026
• Show olderLoading…