CVE-2026-56738 | | | 2026-09-24 | phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and i… |
CVE-2026-47132 | Medium | 5.4 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat use… |
CVE-2026-56737 | High | 8.1 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verificat… |
CVE-2026-56736 | High | 8.2 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated u… |
CVE-2026-85593 | Medium | 5.4 | 2026-09-04 | phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on s… |
CVE-2026-85592 | Low | 3.7 | 2026-09-04 | phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants acces… |
CVE-2026-85591 | | | 2026-09-04 | phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to cha… |
CVE-2026-85590 | | | 2026-09-04 | phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig(… |
CVE-2026-85589 | | | 2026-09-04 | phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only… |
CVE-2026-85588 | | | 2026-09-04 | phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extra… |
CVE-2026-85587 | | | 2026-09-04 | phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attac… |
CVE-2026-85586 | | | 2026-09-04 | phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can… |
CVE-2026-76215 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attacker… |
CVE-2026-76214 | High | 7.4 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key obj… |
CVE-2026-76213 | High | 7.4 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each… |
CVE-2026-76212 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Da… |
CVE-2026-76211 | Medium | 4.3 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard co… |
CVE-2026-76210 | Medium | 6.5 | 2026-08-19 | phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ cont… |
CVE-2026-76209 | Medium | 4.3 | 2026-08-19 | phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when regi… |
CVE-2026-76207 | High | 8.1 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attacker… |
CVE-2026-76206 | Medium | 5.3 | 2026-08-19 | phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. At… |
CVE-2026-76205 | High | 8.1 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embeddin… |
CVE-2026-75920 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database crede… |
CVE-2026-75919 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and c… |
CVE-2026-75918 | High | 8.8 | 2026-08-19 | phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the… |
CVE-2026-66399 | Medium | 6.5 | 2026-07-27 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management p… |
CVE-2026-66398 | | | 2026-07-27 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT… |
CVE-2026-66397 | | | 2026-07-27 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delet… |
CVE-2026-49205 | Medium | 6.5 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed thi… |
CVE-2026-48488 | | | 2026-06-08 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-… |
CVE-2026-35676 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account… |
CVE-2026-35675 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user ac… |
CVE-2026-35672 | High | 7.5 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to cr… |
CVE-2026-35671 | High | 8.8 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrato… |
CVE-2026-46367 | High | 7.6 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malfor… |
CVE-2026-46366 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenti… |
CVE-2026-46365 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user… |
CVE-2026-46364 | Critical | 9.8 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods t… |
CVE-2026-46363 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode… |
CVE-2026-46362 | Medium | 6.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution… |
CVE-2026-46361 | Medium | 6.9 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the… |
CVE-2026-46360 | Medium | 5.4 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iter… |
CVE-2026-46359 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injec… |
CVE-2026-45010 | Critical | 9.1 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary… |
CVE-2026-45009 | Medium | 4.3 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrativ… |
CVE-2026-45008 | Medium | 6.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitr… |
CVE-2026-45007 | Medium | 4.3 | 2026-05-15 | phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermi… |
CVE-2026-34974 | Medium | 5.4 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML… |
CVE-2026-34973 | Medium | 5.3 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_str… |
CVE-2026-34729 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). Thi… |
CVE-2026-34728 | High | 8.7 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser… |
CVE-2026-32629 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntac… |
CVE-2026-27836 | High | 7.5 | 2026-02-27 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accoun… |
CVE-2026-24422 | Medium | 5.3 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2026-24421 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any a… |
CVE-2025-69200 | High | 7.5 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backu… |
CVE-2025-68951 | Medium | 5.4 | 2025-12-29 | phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to ex… |
CVE-2025-62519 | High | 7.2 | 2025-11-17 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update function… |
CVE-2025-59943 | High | 8.1 | 2025-10-03 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration… |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-29179 | Medium | 4.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachme… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-28107 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in th… |
CVE-2024-28106 | Medium | 4.3 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2024-27300 | Medium | 5.5 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page… |
CVE-2024-27299 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the… |
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2024-22208 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticat… |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2023-6890 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-6889 | Medium | 5.4 | 2023-12-16 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. |
CVE-2023-5867 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5864 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5863 | Medium | 6.1 | 2023-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5320 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5319 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5317 | Medium | 5.4 | 2023-09-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5316 | Medium | 6.1 | 2023-09-30 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
CVE-2023-5227 | Critical | 9.8 | 2023-09-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2023-4007 | Medium | 5.4 | 2023-07-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-4006 | Critical | 9.8 | 2023-07-31 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-3469 | Medium | 4.8 | 2023-06-30 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. |
CVE-2023-2999 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2998 | Medium | 6.1 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14. |
CVE-2023-2753 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2752 | Medium | 5.4 | 2023-05-17 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta. |
CVE-2023-2550 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2427 | Medium | 4.8 | 2023-05-05 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2429 | Critical | 9.8 | 2023-04-30 | Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-2428 | Medium | 5.4 | 2023-04-30 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. |
CVE-2023-1875 | Medium | 5.4 | 2023-04-22 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|
CVE-2023-1887 | Medium | 4.3 | 2023-04-05 | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2023-1886 | High | 7.3 | 2023-04-05 | Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
|