Thorsten / phpMyFAQ
62 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-47132 | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | MEDIUM | 5.4 | Sep 24, 2026 |
| CVE-2026-56738 | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | HIGH | 8.5 | Sep 24, 2026 |
| CVE-2026-56737 | phpMyFAQ's two-factor authentication login bypasses the password factor | HIGH | 8.1 | Sep 24, 2026 |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | HIGH | 8.2 | Sep 24, 2026 |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | MEDIUM | 5.1 | Sep 4, 2026 |
| CVE-2026-85592 | phpMyFAQ before 4.1.8 Authorization Bypass via question/create | MEDIUM | 6.3 | Sep 4, 2026 |
| CVE-2026-85591 | phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change | HIGH | 7.1 | Sep 4, 2026 |
| CVE-2026-85590 | phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable | HIGH | 7.1 | Sep 4, 2026 |
| CVE-2026-85589 | phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API | MEDIUM | 5.3 | Sep 4, 2026 |
| CVE-2026-85588 | phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export | MEDIUM | 5.3 | Sep 4, 2026 |
| CVE-2026-85587 | phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages | MEDIUM | 5.3 | Sep 4, 2026 |
| CVE-2026-85586 | phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter | MEDIUM | 6.9 | Sep 4, 2026 |
| CVE-2026-76215 | phpMyFAQ before 4.1.7 Missing Authorization via child resources | MEDIUM | 6.9 | Aug 19, 2026 |
| CVE-2026-76214 | phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge | CRITICAL | 9.1 | Aug 19, 2026 |
| CVE-2026-76213 | phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle | CRITICAL | 9.1 | Aug 19, 2026 |
| CVE-2026-76212 | phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL | MEDIUM | 6.9 | Aug 19, 2026 |
| CVE-2026-76211 | phpMyFAQ before 4.1.7 Information Disclosure via Admin API | MEDIUM | 5.3 | Aug 19, 2026 |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | HIGH | 7.1 | Aug 19, 2026 |
| CVE-2026-76209 | phpMyFAQ before v4.1.6 Registration Bypass via API | MEDIUM | 5.3 | Aug 19, 2026 |
| CVE-2026-76208 | phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP | HIGH | 8.8 | Aug 19, 2026 |
| CVE-2026-76207 | phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie | HIGH | 8.6 | Aug 19, 2026 |
| CVE-2026-76206 | phpMyFAQ before 4.1.7 Information Disclosure via PDF Export | MEDIUM | 6.9 | Aug 19, 2026 |
| CVE-2026-76205 | phpMyFAQ before 4.1.7 SQL Injection via Glossary | HIGH | 8.6 | Aug 19, 2026 |
| CVE-2026-75920 | phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP | MEDIUM | 6.0 | Aug 19, 2026 |
| CVE-2026-75919 | phpMyFAQ before 4.1.7 Authentication Bypass via Setup API | MEDIUM | 6.9 | Aug 19, 2026 |
Showing 1 to 25 of 62 CVEs