What’s Vulnerable › Products
thorsten phpMyFAQ vulnerabilities
225 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 99 published in the last 12 months.
Check whether your thorsten phpMyFAQ version is affected
Latest thorsten phpMyFAQ vulnerabilities
- CVE-2026-116183 — phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID (CVSS 7.5)
- CVE-2026-116182 — phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching (CVSS 5.0)
- CVE-2026-111911 — phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection (CVSS 9.8)
- CVE-2026-111910 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads (CVSS 6.5)
- CVE-2026-111909 — phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API (CVSS 8.1)
- CVE-2026-111908 — phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API (CVSS 8.3)
- CVE-2026-111907 — phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database (CVSS 7.1)
- CVE-2026-111906 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations (CVSS 6.5)
- CVE-2026-111905 — phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data (CVSS 6.0)
- CVE-2026-111904 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API (CVSS 5.3)
- CVE-2026-111903 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass (CVSS 5.4)
- CVE-2026-111902 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API (CVSS 5.3)
- CVE-2026-111901 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination (CVSS 7.5)
- CVE-2026-111900 — phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php (CVSS 4.3)
- CVE-2026-111898 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking (CVSS 7.5)
- CVE-2026-111897 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints (CVSS 7.1)
- CVE-2026-111896 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass (CVSS 5.4)
- CVE-2026-111895 — phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username (CVSS 6.8)
- CVE-2026-111894 — phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI (CVSS 5.4)
- CVE-2026-111893 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API (CVSS 6.5)
- CVE-2026-111892 — phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints (CVSS 6.5)
- CVE-2026-111891 — phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API (CVSS 5.5)
- CVE-2026-111890 — phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights (CVSS 5.5)
- CVE-2026-111889 — phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard (CVSS 4.3)
- CVE-2026-111888 — phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API (CVSS 2.7)