CVE-2026-66399 | Medium | 6.5 | 2026-07-27 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management p… |
CVE-2026-66398 | | | 2026-07-27 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT… |
CVE-2026-66397 | | | 2026-07-27 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delet… |
CVE-2026-49205 | Medium | 6.5 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed thi… |
CVE-2026-48488 | | | 2026-06-08 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-… |
CVE-2026-35676 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account… |
CVE-2026-35675 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user ac… |
CVE-2026-35672 | High | 7.5 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to cr… |
CVE-2026-35671 | High | 8.8 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrato… |
CVE-2026-46367 | High | 7.6 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malfor… |
CVE-2026-46366 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenti… |
CVE-2026-46365 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user… |
CVE-2026-46364 | Critical | 9.8 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods t… |
CVE-2026-46363 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode… |
CVE-2026-46362 | Medium | 6.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution… |
CVE-2026-46361 | Medium | 6.9 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the… |
CVE-2026-46360 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iter… |
CVE-2026-46359 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injec… |
CVE-2026-45010 | Critical | 9.1 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary… |
CVE-2026-45009 | Medium | 4.3 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrativ… |
CVE-2026-45008 | Medium | 6.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitr… |
CVE-2026-45007 | Medium | 4.3 | 2026-05-15 | phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermi… |
CVE-2026-34974 | Medium | 5.4 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML… |
CVE-2026-34973 | Medium | 5.3 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_str… |
CVE-2026-34729 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). Thi… |
CVE-2026-34728 | High | 8.7 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser… |
CVE-2026-32629 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntac… |
CVE-2026-27836 | High | 7.5 | 2026-02-27 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accoun… |
CVE-2026-24422 | Medium | 5.3 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2026-24421 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any a… |
CVE-2025-69200 | High | 7.5 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backu… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2025-62519 | High | 7.2 | 2025-11-17 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update function… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-29179 | Medium | 4.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachme… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-28107 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in th… |
CVE-2024-28106 | Medium | 4.3 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2024-27300 | Medium | 5.5 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page… |
CVE-2024-27299 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the… |
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2024-22208 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticat… |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2023-6890 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6889 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-5867 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5864 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5863 | Medium | 6.1 | 2023-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5320 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5319 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5317 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5316 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5227 | Critical | 9.8 | 2023-09-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2023-4007 | Medium | 5.4 | 2023-07-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-4006 | Critical | 9.8 | 2023-07-31 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-3469 | Medium | 4.8 | 2023-06-30 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. |
CVE-2023-2999 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2998 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2753 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2752 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2550 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2427 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2429 | Critical | 9.8 | 2023-04-30 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2428 | Medium | 5.4 | 2023-04-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-1875 | Medium | 5.4 | 2023-04-22 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1887 | Medium | 4.3 | 2023-04-05 | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1886 | High | 7.3 | 2023-04-05 | Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1885 | Medium | 6.3 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1884 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1883 | Medium | 5.4 | 2023-04-05 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1882 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1880 | Medium | 6.1 | 2023-04-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1879 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1878 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1758 | Medium | 5.4 | 2023-04-05 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1757 | Medium | 5.4 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1756 | Medium | 4.7 | 2023-04-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1762 | High | 8.8 | 2023-03-31 | Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1761 | Medium | 6.3 | 2023-03-31 | Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1760 | Medium | 4.8 | 2023-03-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1759 | Medium | 4.8 | 2023-03-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1755 | Medium | 5.4 | 2023-03-31 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1754 | Medium | 4.7 | 2023-03-31 | Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1753 | Medium | 5.5 | 2023-03-31 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-0880 | High | 8.3 | 2023-02-17 | Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0794 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0793 | High | 7.1 | 2023-02-12 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0792 | Medium | 6.5 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0791 | High | 8.3 | 2023-02-12 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0790 | High | 7.6 | 2023-02-12 | Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0789 | High | 8.1 | 2023-02-12 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|
CVE-2023-0788 | High | 8.1 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
|