thorsten phpMyFAQ

• CVE-2026-76209 Medium 4.3 phpMyFAQ before v4.1.6 Registration Bypass via API 0.3%
• CVE-2026-76208 High 8.2 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP 0.4%
• CVE-2026-76207 High 8.1 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie 0.5%
• CVE-2026-76206 Medium 5.3 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export 0.4%
• CVE-2026-76205 High 8.1 phpMyFAQ before 4.1.7 SQL Injection via Glossary 0.4%
• CVE-2026-75920 Medium 5.3 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP 0.4%
• CVE-2026-75919 Medium 5.3 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API 0.5%
• CVE-2026-75918 High 8.8 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File 0.5%
• CVE-2026-66399 Medium 6.5 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership 0.3%
• CVE-2026-66398 Critical 9.4 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API 0.4%
• CVE-2026-66397 High 8.6 phpMyFAQ before 4.1.6 Path Traversal via category image deletion 0.4%
• CVE-2026-49205 Medium 6.5 phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) 0.4%
• CVE-2026-48488 Low 2.7 phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing 0.2%
• CVE-2026-35676 High 8.2 phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint 0.3%
• CVE-2026-35675 High 8.2 phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update 0.4%
• CVE-2026-35672 High 7.5 phpMyFAQ - Authentication Bypass via Empty API Token 0.5%
• CVE-2026-35671 High 8.8 phpMyFAQ - Insecure Direct Object Reference in User Password API 0.4%
• CVE-2026-46367 High 7.6 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering 0.2%
• CVE-2026-46366 High 7.5 phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass 0.3%
• CVE-2026-46365 Medium 5.4 phpMyFAQ - Missing Authorization in Tag Deletion Endpoint 0.2%
• CVE-2026-46364 Critical 9.8 phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha 1.7%
• CVE-2026-46363 Medium 5.4 phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass 0.2%
• CVE-2026-46362 Medium 6.5 phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check 0.3%
• CVE-2026-46361 Medium 6.9 phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig 0.3%
• CVE-2026-46360 Medium 5.4 phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer 0.2%
• CVE-2026-46359 High 7.5 phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields 0.3%
• CVE-2026-45010 Critical 9.1 phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint 0.4%
• CVE-2026-45009 Medium 4.3 phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints 0.2%
• CVE-2026-45008 Medium 6.5 phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter 0.3%
• CVE-2026-45007 Medium 4.3 phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure 0.3%
• CVE-2026-34974 Medium 5.4 phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation 0.2%
• CVE-2026-34973 Medium 6.9 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure 0.3%
• CVE-2026-34729 Medium 6.1 phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() 0.3%
• CVE-2026-34728 High 8.7 phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController 0.7%
• CVE-2026-32629 Medium 5.4 phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor 0.3%
• CVE-2026-27836 High 7.5 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint 0.5%
• CVE-2026-24422 Medium 5.3 phpMyFAQ: Public API endpoints expose emails and invisible questions 0.4%
• CVE-2026-24420 Medium 6.5 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) 0.5%
• CVE-2026-24421 Medium 6.5 phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user 1.7%
• CVE-2025-69200 High 7.5 phpMyFAQ has unauthenticated config backup download via /api/setup/backup 2.1%
• CVE-2025-68951 Medium 5.4 phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw 0.3%
• CVE-2025-62519 High 7.2 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality 0.8%
• CVE-2025-59943 High 8.1 phpMyFAQ duplicate email registration allows multiple accounts with the same email 0.4%
• CVE-2024-56199 Medium 5.2 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ 0.4%
• CVE-2024-55889 Medium 4.9 phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames 2.2%
• CVE-2024-54141 High 8.6 phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available 0.5%
• CVE-2024-29196 Low 3.8 phpMyFAQ Path Traversal in Attachments 0.6%
• CVE-2024-29179 Medium 4.3 phpMyFAQ Stored Cross-site Scripting at File Attachments 0.5%
• CVE-2024-28108 Medium 4.7 phpMyFAQ Stored HTML Injection at contentLink 0.5%
• CVE-2024-28107 High 8.8 phpMyFAQ SQL injections at insertentry & saveentry 1.0%