PackagistPackage

thorsten/phpmyfaq

112 known vulnerabilities (7 critical, 52 high, 51 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 112 · 7 critical, 52 high, 51 medium, 1 low

Registry: Packagist

Advisories 112

CVE-2026-47132Medium 5.4
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Affected: fixed in 4.2.0-alpha.
CVE-2026-56738High 8.5
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
Affected: fixed in 4.1.6.
CVE-2026-56737High 8.1
phpMyFAQ's two-factor authentication login bypasses the password factor
Affected: from 3.2.0, fixed in 4.1.6.
CVE-2026-56736High 8.2
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Affected: fixed in 4.2.0-alpha.
CVE-2026-57994Medium 6.9
phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints
Affected: from 4.1.0, fixed in 4.1.5.
CVE-2026-57961Medium 5.1
phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function
Affected: from 4.0.0-alpha, fixed in 4.1.5.
CVE-2026-57995High 8.7
phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions
Affected: fixed in 4.1.5.
CVE-2026-56396High 8.7
phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()
Affected: fixed in 4.1.4.
CVE-2026-49205Medium 6.5
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Affected: fixed in 4.1.4.
CVE-2026-48488Low 2.7
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Affected: fixed in 4.1.4.
CVE-2026-35676High 8.2
phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint
Affected: fixed in 4.1.3.
CVE-2026-35675High 8.2
phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
Affected: fixed in 4.1.3.
CVE-2026-35672High 7.5
phpMyFAQ - Authentication Bypass via Empty API Token
Affected: fixed in 4.1.3.
CVE-2026-35671High 8.8
phpMyFAQ - Insecure Direct Object Reference in User Password API
Affected: fixed in 4.1.3.
CVE-2026-46367High 7.6
phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
Affected: from 4.1.1, fixed in 4.1.2.

Show all 112 advisoriesShow fewer advisories

CVE-2026-46366High 7.5
phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass
Affected: fixed in 4.1.2.
CVE-2026-46365Medium 5.4
phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
Affected: fixed in 4.1.2.
CVE-2026-46364Critical 9.8
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
Affected: fixed in 4.1.2.
CVE-2026-46363Medium 5.4
phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
Affected: fixed in 4.1.2.
CVE-2026-46362Medium 6.5
phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
Affected: fixed in 4.1.2.
CVE-2026-46361Medium 6.9
phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig
Affected: fixed in 4.1.2.
CVE-2026-46360Medium 5.4
phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer
Affected: fixed in 4.1.2.
CVE-2026-46359High 7.5
phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields
Affected: fixed in 4.1.2.
CVE-2026-45010Critical 9.1
phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint
Affected: fixed in 4.1.2.
CVE-2026-45009Medium 4.3
phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
Affected: from 4.1.1, fixed in 4.1.2.
CVE-2026-45008Medium 6.5
phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter
Affected: fixed in 4.1.2.
CVE-2026-45007Medium 4.3
phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure
Affected: fixed in 4.1.2.
CVE-2026-34974Medium 5.4
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation
Affected: fixed in 4.1.1.
CVE-2026-34973Medium 6.9
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Affected: fixed in 4.1.1.
CVE-2026-32629Medium 5.4
phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor
Affected: fixed in 4.1.1.
CVE-2026-27836High 7.5
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
Affected: fixed in 4.0.18.
CVE-2026-24422Medium 5.3
phpMyFAQ: Public API endpoints expose emails and invisible questions
Affected: fixed in 4.0.17.
CVE-2026-24420Medium 6.5
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
Affected: fixed in 4.0.17.
CVE-2026-24421Medium 6.5
phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user
Affected: fixed in 4.0.17.
CVE-2025-69200High 7.5
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
Affected: fixed in 4.0.16; from 4.1.0-alpha, through 4.1.0-beta.2.
CVE-2025-68951Medium 5.4
phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw
Affected: from 4.0.14, fixed in 4.0.16.
CVE-2023-53929Medium 6.2
phpMyFAQ 3.1.12 CSV Injection via User Profile Export
Affected: through 3.1.12.
CVE-2025-62519High 7.2
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Affected: fixed in 4.0.14.
CVE-2025-59943High 8.1
phpMyFAQ duplicate email registration allows multiple accounts with the same email
Affected: from 4.0.7, fixed in 4.0.13.
CVE-2024-56199Medium 5.2
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
Affected: from 3.2.10, through 4.0.1.
CVE-2024-55889Medium 4.9
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
Affected: fixed in 3.2.10.
CVE-2024-54141High 8.6
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available
Affected: fixed in 4.0.0.
CVE-2023-6890Medium 5.4
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.17.
CVE-2023-6889Medium 5.4
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.17.
CVE-2023-5866Medium 6.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq
Affected: fixed in 3.2.1.
CVE-2023-5867Medium 4.6
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.2.2.
CVE-2023-5865High 7.6
Insufficient Session Expiration in thorsten/phpmyfaq
Affected: fixed in 3.2.2.
CVE-2023-5864High 7.4
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.2.1.
CVE-2023-5863High 7.4
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.2.2.
CVE-2023-5320Critical 9.0
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Affected: fixed in 3.1.18.
CVE-2023-5317Medium 6.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.18.
CVE-2023-5316Critical 9.1
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Affected: fixed in 3.1.18.
CVE-2023-5319High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.18.
CVE-2023-5227Medium 6.5
Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq
Affected: fixed in 3.1.18.
CVE-2023-4007High 8.8
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.16.
CVE-2023-4006High 8.8
Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq
Affected: fixed in 3.1.16.
CVE-2023-3469Medium 5.2
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.2.0-beta.2.
CVE-2023-2999Medium 6.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.14.
CVE-2023-2998Medium 6.0
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.14.
CVE-2023-2753High 7.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.2.0-beta.
CVE-2023-2752High 7.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.2.0-beta.
CVE-2023-2550High 8.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.13.
CVE-2023-2427Medium 6.1
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.1.13.
CVE-2023-2429Medium 6.6
Improper Access Control in thorsten/phpmyfaq
Affected: fixed in 3.1.13.
CVE-2023-2428Medium 6.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.13.
CVE-2023-1875Medium 5.4
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1887High 8.3
Business Logic Errors in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1886High 7.3
Authentication Bypass by Capture-replay in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1885Medium 6.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1884Medium 4.7
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1883Medium 5.4
Improper Access Control in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1882High 8.1
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1880High 8.3
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1879Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1878High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1758High 8.9
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1757High 8.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1756Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1762High 7.2
Improper Privilege Management in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1761Medium 6.3
Cross-site Scripting in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1760High 8.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1759Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1755High 8.4
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1754Medium 4.7
Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-1753Medium 5.5
Weak Password Requirements in thorsten/phpmyfaq
Affected: fixed in 3.1.12.
CVE-2023-0880High 8.3
Misinterpretation of Input in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0794High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0793High 7.1
Weak Password Requirements in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0792Medium 6.5
Code Injection in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0791High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0790High 7.6
Uncaught Exception in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0789High 8.1
Command Injection in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0788High 8.1
Code Injection in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0787High 8.1
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0786High 8.4
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Affected: fixed in 3.1.11.
CVE-2023-0314Medium 6.5
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0313Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0312High 8.6
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0311Medium 5.3
Improper Authentication in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0310Critical 9.8
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0309High 8.6
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0308High 7.6
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0307Medium 5.7
Weak Password Requirements in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2023-0306Critical 9.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.10.
CVE-2022-4409Medium 6.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq
Affected: fixed in 3.1.9.
CVE-2022-4408Medium 4.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.9.
CVE-2022-4407Critical 9.8
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.1.9.
CVE-2022-3766High 7.3
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Affected: fixed in 3.1.8.
CVE-2022-3765High 8.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.1.8.
CVE-2022-3754High 7.5
Weak Password Requirements in thorsten/phpmyfaq
Affected: fixed in 3.1.8.
CVE-2022-3608High 7.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: fixed in 3.2.0-alpha.
CVE-2018-16650Unrated
phpMyFAQ before 2.9.11 allows CSRF.
Affected: fixed in 2.9.11.