thorsten phpMyFAQ

• CVE-2026-116183 High 7.5 phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID 0.2%
• CVE-2026-116182 Medium 5.0 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching 0.2%
• CVE-2026-111911 Critical 9.8 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection 0.5%
• CVE-2026-111910 Medium 6.5 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads 0.3%
• CVE-2026-111909 High 8.1 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API 0.3%
• CVE-2026-111908 High 8.3 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API 0.4%
• CVE-2026-111907 High 7.1 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database 0.1%
• CVE-2026-111906 Medium 6.5 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations 0.2%
• CVE-2026-111905 Medium 6.0 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data 0.4%
• CVE-2026-111904 Medium 5.3 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API 0.3%
• CVE-2026-111903 Medium 5.4 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass 0.2%
• CVE-2026-111902 Medium 5.3 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API 0.3%
• CVE-2026-111901 High 7.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination 0.4%
• CVE-2026-111900 Medium 4.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php 0.3%
• CVE-2026-111898 High 7.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking 0.4%
• CVE-2026-111897 High 7.1 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints 0.3%
• CVE-2026-111896 Medium 5.4 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass 0.2%
• CVE-2026-111895 Medium 6.8 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username 0.4%
• CVE-2026-111894 Medium 5.4 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI 0.2%
• CVE-2026-111893 Medium 6.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API 0.4%
• CVE-2026-111892 Medium 6.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints 0.3%
• CVE-2026-111891 Medium 5.5 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API 0.2%
• CVE-2026-111890 Medium 5.5 phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights 0.3%
• CVE-2026-111889 Medium 4.3 phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard 0.3%
• CVE-2026-111888 Low 2.7 phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API 0.3%
• CVE-2026-111887 Medium 5.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint 0.3%
• CVE-2026-111886 Medium 6.5 phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint 0.3%
• CVE-2026-111885 Medium 5.5 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API 0.3%
• CVE-2026-111884 High 8.3 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover 0.3%
• CVE-2026-111882 High 8.1 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks 0.4%
• CVE-2026-109573 High 8.1 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint 0.3%
• CVE-2026-108851 Low 3.3 phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool 0.2%
• CVE-2026-47132 Medium 5.4 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration 0.3%
• CVE-2026-56738 High 8.5 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion 0.3%
• CVE-2026-56737 High 8.1 phpMyFAQ's two-factor authentication login bypasses the password factor 0.5%
• CVE-2026-56736 High 8.2 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission 0.2%
• CVE-2026-85593 Medium 5.4 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode 0.2%
• CVE-2026-85592 Low 3.7 phpMyFAQ before 4.1.8 Authorization Bypass via question/create 0.3%
• CVE-2026-85591 High 7.1 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change 0.5%
• CVE-2026-85590 High 7.1 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable 0.5%
• CVE-2026-85589 Medium 5.3 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API 0.5%
• CVE-2026-85588 Medium 5.3 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export 0.5%
• CVE-2026-85587 Medium 5.3 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages 0.4%
• CVE-2026-85586 Medium 6.9 phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter 0.5%
• CVE-2026-76215 Medium 5.3 phpMyFAQ before 4.1.7 Missing Authorization via child resources 0.4%
• CVE-2026-76214 High 7.4 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge 0.4%
• CVE-2026-76213 High 7.4 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle 0.4%
• CVE-2026-76212 Medium 5.3 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL 0.4%
• CVE-2026-76211 Medium 4.3 phpMyFAQ before 4.1.7 Information Disclosure via Admin API 0.3%
• CVE-2026-76210 Medium 6.5 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export 0.4%