Tthorsten

Products

Exploited and recent CVEs

• CVE-2026-116183 High 7.5 phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID 0.2%
• CVE-2026-116182 Medium 5.0 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching 0.2%
• CVE-2026-111911 Critical 9.8 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection 0.5%
• CVE-2026-111910 Medium 6.5 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads 0.3%
• CVE-2026-111909 High 8.1 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API 0.3%
• CVE-2026-111908 High 8.3 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API 0.4%
• CVE-2026-111907 High 7.1 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database 0.1%
• CVE-2026-111906 Medium 6.5 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations 0.2%
• CVE-2026-111905 Medium 6.0 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data 0.4%
• CVE-2026-111904 Medium 5.3 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API 0.3%
• CVE-2026-111903 Medium 5.4 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass 0.2%
• CVE-2026-111902 Medium 5.3 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API 0.3%
• CVE-2026-111901 High 7.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination 0.4%
• CVE-2026-111900 Medium 4.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php 0.3%
• CVE-2026-111898 High 7.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking 0.4%
• CVE-2026-111897 High 7.1 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints 0.3%
• CVE-2026-111896 Medium 5.4 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass 0.2%
• CVE-2026-111895 Medium 6.8 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username 0.4%
• CVE-2026-111894 Medium 5.4 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI 0.2%
• CVE-2026-111893 Medium 6.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API 0.4%
• CVE-2026-111892 Medium 6.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints 0.3%
• CVE-2026-111891 Medium 5.5 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API 0.2%
• CVE-2026-111890 Medium 5.5 phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights 0.3%
• CVE-2026-111889 Medium 4.3 phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard 0.3%
• CVE-2026-111888 Low 2.7 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API 0.3%
• CVE-2026-111887 Medium 5.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint 0.3%
• CVE-2026-111886 Medium 6.5 phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint 0.3%
• CVE-2026-111885 Medium 5.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API 0.3%
• CVE-2026-111884 High 8.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover 0.3%
• CVE-2026-111882 High 8.1 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks 0.4%