CVE-2026-57996 | High | 8.8 | 2026-07-15 | phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin… |
CVE-2026-57994 | Medium | 5.3 | 2026-07-10 | phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to… |
CVE-2026-57961 | Low | 2.7 | 2026-07-10 | phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper… |
CVE-2026-57995 | High | 8.8 | 2026-06-30 | phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitr… |
CVE-2026-56396 | High | 8.8 | 2026-06-21 | phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to… |
CVE-2026-34974 | Medium | 5.4 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML… |
CVE-2026-34973 | Medium | 5.3 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_str… |
CVE-2026-34729 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). Thi… |
CVE-2026-34728 | High | 8.7 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser… |
CVE-2026-32629 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntac… |
CVE-2026-27836 | High | 7.5 | 2026-02-27 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accoun… |
CVE-2026-24422 | Medium | 5.3 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2026-24421 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any a… |
CVE-2025-69200 | High | 7.5 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backu… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2023-53929 | High | 8.8 | 2025-12-17 | phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can mod… |
CVE-2025-62519 | High | 7.2 | 2025-11-17 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update function… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-29179 | Medium | 4.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachme… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-28107 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in th… |
CVE-2024-28106 | Medium | 4.3 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2024-27300 | Medium | 5.5 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page… |
CVE-2024-27299 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the… |
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2024-22208 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticat… |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2023-6890 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6889 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-5867 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5864 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5863 | Medium | 6.1 | 2023-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5320 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5319 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5317 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5316 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5227 | Critical | 9.8 | 2023-09-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2023-4007 | Medium | 5.4 | 2023-07-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-4006 | Critical | 9.8 | 2023-07-31 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-3469 | Medium | 4.8 | 2023-06-30 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. |
CVE-2023-2999 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2998 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2753 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2752 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2550 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2427 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2429 | Critical | 9.8 | 2023-04-30 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2428 | Medium | 5.4 | 2023-04-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-1875 | Medium | 5.4 | 2023-04-22 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1887 | Medium | 4.3 | 2023-04-05 | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1886 | High | 7.3 | 2023-04-05 | Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1885 | Medium | 6.3 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1884 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1883 | Medium | 5.4 | 2023-04-05 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1882 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1880 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1879 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1878 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1758 | Medium | 5.4 | 2023-04-05 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1757 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1756 | Medium | 4.7 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1762 | High | 8.8 | 2023-03-31 | Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1761 | Medium | 6.3 | 2023-03-31 | Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1760 | Medium | 4.8 | 2023-03-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1759 | Medium | 4.8 | 2023-03-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1755 | Medium | 5.4 | 2023-03-31 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1754 | Medium | 4.7 | 2023-03-31 | Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1753 | Medium | 5.5 | 2023-03-31 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-0880 | High | 8.3 | 2023-02-17 | Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0794 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0793 | High | 7.1 | 2023-02-12 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0792 | Medium | 6.5 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0791 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0790 | High | 7.6 | 2023-02-12 | Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0789 | High | 8.1 | 2023-02-12 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0788 | High | 8.1 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0787 | High | 8.1 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0786 | High | 8.4 | 2023-02-12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0314 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0313 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0312 | Medium | 6.1 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0310 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0309 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0308 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0307 | Critical | 9.8 | 2023-01-15 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-0306 | Medium | 5.4 | 2023-01-15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4408 | Medium | 5.4 | 2022-12-11 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4407 | Medium | 6.1 | 2022-12-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-3766 | Medium | 6.1 | 2022-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-3765 | Medium | 5.4 | 2022-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |