Skip to contentThorsten Phpmyfaq vulnerabilities
- phpmyfaqphpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPCVE-2026-762088.8 High
- phpmyfaqphpMyFAQ before 4.1.7 2FA Bypass via Remember-Me CookieCVE-2026-762078.6 High
- phpmyfaqphpMyFAQ before 4.1.7 Information Disclosure via PDF ExportCVE-2026-762066.9 Medium
- phpmyfaqphpMyFAQ before 4.1.7 SQL Injection via GlossaryCVE-2026-762058.6 High
- phpmyfaqphpMyFAQ before 4.1.6 Information Disclosure via Backup ZIPCVE-2026-759206.0 Medium
- phpmyfaqphpMyFAQ before 4.1.7 Authentication Bypass via Setup APICVE-2026-759196.9 Medium
- phpmyfaqphpMyFAQ before 4.1.7 Authentication Bypass via Tracking FileCVE-2026-759188.7 High
- thorsten phpmyfaqphpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationCVE-2026-47132Fix available5.4 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.6 Privilege Escalation via Group MembershipCVE-2026-663998.5 High
- thorsten phpmyfaqphpMyFAQ before 4.1.6 Remote Code Execution via Configuration APICVE-2026-663989.4 Critical
- thorsten phpmyfaqphpMyFAQ before 4.1.6 Path Traversal via category image deletionCVE-2026-663978.6 High
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add EndpointCVE-2026-579968.7 High
- phpmyfaqphpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API EndpointsCVE-2026-57994Fix available6.9 Medium
- phpmyfaqphpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths FunctionCVE-2026-57961Fix available5.1 Medium
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissionsCVE-2026-57995Fix available8.7 High
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()CVE-2026-56396Fix available8.7 High
- thorsten phpmyfaqphpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)CVE-2026-49205Fix available6.5 Medium
- thorsten phpmyfaqphpMyFAQ has Weak Cryptography - SHA1 for Password HashingCVE-2026-48488Fix available2.7 Low
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/updateCVE-2026-35675Fix available8.8 High
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Empty API TokenCVE-2026-35672Fix available8.7 High
- thorsten phpmyfaqphpMyFAQ - Insecure Direct Object Reference in User Password APICVE-2026-35671Fix available8.7 High
- thorsten phpmyfaqphpMyFAQ - Unauthenticated Password Reset via User Password Update EndpointCVE-2026-35676Fix available8.8 High
- thorsten phpmyfaqphpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptchaCVE-2026-46364Fix available9.3 Critical
- thorsten phpmyfaqphpMyFAQ - Path Traversal in Client::deleteClientFolder via URL ParameterCVE-2026-45008Fix available7.0 High
- thorsten phpmyfaqphpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission BypassCVE-2026-46366Fix available8.7 High
- thorsten phpmyfaqphpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token FieldsCVE-2026-46359Fix available7.7 High
- thorsten phpmyfaqphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointCVE-2026-45010Fix available9.3 Critical
- thorsten phpmyfaqphpMyFAQ - Insufficient Authorization Check in Admin API EndpointsCVE-2026-45009Fix available5.3 Medium
- thorsten phpmyfaqphpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twigCVE-2026-46361Fix available8.2 High
- thorsten phpmyfaqphpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information DisclosureCVE-2026-45007Fix available5.3 Medium
- thorsten phpmyfaqphpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG SanitizerCVE-2026-46360Fix available5.1 Medium
- thorsten phpmyfaqphpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode BypassCVE-2026-46363Fix available5.1 Medium
- thorsten phpmyfaqphpMyFAQ - Missing Authorization in Tag Deletion EndpointCVE-2026-46365Fix available5.3 Medium
- thorsten phpmyfaqphpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission CheckCVE-2026-46362Fix available7.1 High
- thorsten phpmyfaqphpMyFAQ - Stored XSS via Utils::parseUrl() in Comment RenderingCVE-2026-46367Fix available8.3 High
- phpmyfaqphpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege EscalationCVE-2026-34974Fix available5.4 Medium
- phpmyfaqphpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content DisclosureCVE-2026-34973Fix available6.9 Medium
- phpmyfaqphpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()CVE-2026-34729Fix available6.1 Medium
- phpmyfaqphpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserControllerCVE-2026-34728Fix available8.7 High
- phpmyfaqphpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ EditorCVE-2026-32629Fix available5.4 Medium
- phpmyfaqphpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare EndpointCVE-2026-27836Fix available7.5 High
- phpmyfaqphpMyFAQ: Public API endpoints expose emails and invisible questionsCVE-2026-24422Fix available5.3 Medium
- phpmyfaqphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userCVE-2026-24421Public exploitFix available6.5 Medium
- phpmyfaqphpMyFAQ: Attachment download allowed without dlattachment right (broken access control)CVE-2026-24420Fix available6.5 Medium
- phpmyfaqphpMyFAQ has unauthenticated config backup download via /api/setup/backupCVE-2025-69200Fix available7.5 High
- phpmyfaqphpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |rawCVE-2025-68951Fix available5.4 Medium
- phpmyfaqphpMyFAQ 3.1.12 CSV Injection via User Profile ExportCVE-2023-539296.2 Medium
- phpmyfaqphpMyFAQ has Authenticated SQL Injection in Configuration Update FunctionalityCVE-2025-62519Fix available7.2 High
- phpmyfaqphpMyFAQ duplicate email registration allows multiple accounts with the same emailCVE-2025-59943Fix available8.1 High
- phpmyfaqphpMyFAQ Vulnerable to Stored HTML Injection at FAQCVE-2024-561995.2 Medium
- Show moreLoading…