# thorsten/phpmyfaq (Packagist) vulnerabilities

112 known vulnerabilities (7 critical, 52 high, 51 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/thorsten/phpmyfaq

## Advisories (112)

### [CVE-2026-47132](https://cve.now/CVE-2026-47132): phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

- Severity: Medium 5.4
- Published: Sep 24, 2026
- Affected: fixed in 4.2.0-alpha.

### [CVE-2026-56738](https://cve.now/CVE-2026-56738): phpMyFAQ has SQL Injection in \`StopWords::add()\` — Unescaped Stop Word Insertion

- Severity: High 8.5
- Published: Sep 24, 2026
- Affected: fixed in 4.1.6.

### [CVE-2026-56737](https://cve.now/CVE-2026-56737): phpMyFAQ's two-factor authentication login bypasses the password factor

- Severity: High 8.1
- Published: Sep 24, 2026
- Affected: from 3.2.0, fixed in 4.1.6.

### [CVE-2026-56736](https://cve.now/CVE-2026-56736): phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

- Severity: High 8.2
- Published: Sep 24, 2026
- Affected: fixed in 4.2.0-alpha.

### [CVE-2026-57994](https://cve.now/CVE-2026-57994): phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints

- Severity: Medium 6.9
- Published: Jul 10, 2026
- Affected: from 4.1.0, fixed in 4.1.5.

### [CVE-2026-57961](https://cve.now/CVE-2026-57961): phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function

- Severity: Medium 5.1
- Published: Jul 10, 2026
- Affected: from 4.0.0-alpha, fixed in 4.1.5.

### [CVE-2026-57995](https://cve.now/CVE-2026-57995): phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

- Severity: High 8.7
- Published: Jun 30, 2026
- Affected: fixed in 4.1.5.

### [CVE-2026-56396](https://cve.now/CVE-2026-56396): phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()

- Severity: High 8.7
- Published: Jun 21, 2026
- Affected: fixed in 4.1.4.

### [CVE-2026-49205](https://cve.now/CVE-2026-49205): phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

- Severity: Medium 6.5
- Published: Jun 18, 2026
- Affected: fixed in 4.1.4.

### [CVE-2026-48488](https://cve.now/CVE-2026-48488): phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

- Severity: Low 2.7
- Published: Jun 8, 2026
- Affected: fixed in 4.1.4.

### [CVE-2026-35676](https://cve.now/CVE-2026-35676): phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

- Severity: High 8.2
- Published: May 28, 2026
- Affected: fixed in 4.1.3.

### [CVE-2026-35675](https://cve.now/CVE-2026-35675): phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

- Severity: High 8.2
- Published: May 28, 2026
- Affected: fixed in 4.1.3.

### [CVE-2026-35672](https://cve.now/CVE-2026-35672): phpMyFAQ - Authentication Bypass via Empty API Token

- Severity: High 7.5
- Published: May 28, 2026
- Affected: fixed in 4.1.3.

### [CVE-2026-35671](https://cve.now/CVE-2026-35671): phpMyFAQ - Insecure Direct Object Reference in User Password API

- Severity: High 8.8
- Published: May 28, 2026
- Affected: fixed in 4.1.3.

### [CVE-2026-46367](https://cve.now/CVE-2026-46367): phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering

- Severity: High 7.6
- Published: May 15, 2026
- Affected: from 4.1.1, fixed in 4.1.2.

### [CVE-2026-46366](https://cve.now/CVE-2026-46366): phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass

- Severity: High 7.5
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46365](https://cve.now/CVE-2026-46365): phpMyFAQ - Missing Authorization in Tag Deletion Endpoint

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46364](https://cve.now/CVE-2026-46364): phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

- Severity: Critical 9.8
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46363](https://cve.now/CVE-2026-46363): phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46362](https://cve.now/CVE-2026-46362): phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46361](https://cve.now/CVE-2026-46361): phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig

- Severity: Medium 6.9
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46360](https://cve.now/CVE-2026-46360): phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer

- Severity: Medium 5.4
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-46359](https://cve.now/CVE-2026-46359): phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

- Severity: High 7.5
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-45010](https://cve.now/CVE-2026-45010): phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint

- Severity: Critical 9.1
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-45009](https://cve.now/CVE-2026-45009): phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: from 4.1.1, fixed in 4.1.2.

### [CVE-2026-45008](https://cve.now/CVE-2026-45008): phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

- Severity: Medium 6.5
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-45007](https://cve.now/CVE-2026-45007): phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure

- Severity: Medium 4.3
- Published: May 15, 2026
- Affected: fixed in 4.1.2.

### [CVE-2026-34974](https://cve.now/CVE-2026-34974): phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation

- Severity: Medium 5.4
- Published: Apr 2, 2026
- Affected: fixed in 4.1.1.

### [CVE-2026-34973](https://cve.now/CVE-2026-34973): phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and \_ Metacharacters Enable Broad Content Disclosure

- Severity: Medium 6.9
- Published: Apr 2, 2026
- Affected: fixed in 4.1.1.

### [CVE-2026-32629](https://cve.now/CVE-2026-32629): phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

- Severity: Medium 5.4
- Published: Apr 2, 2026
- Affected: fixed in 4.1.1.

### [CVE-2026-27836](https://cve.now/CVE-2026-27836): phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

- Severity: High 7.5
- Published: Feb 27, 2026
- Affected: fixed in 4.0.18.

### [CVE-2026-24422](https://cve.now/CVE-2026-24422): phpMyFAQ: Public API endpoints expose emails and invisible questions

- Severity: Medium 5.3
- Published: Jan 24, 2026
- Affected: fixed in 4.0.17.

### [CVE-2026-24420](https://cve.now/CVE-2026-24420): phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

- Severity: Medium 6.5
- Published: Jan 24, 2026
- Affected: fixed in 4.0.17.

### [CVE-2026-24421](https://cve.now/CVE-2026-24421): phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

- Severity: Medium 6.5
- Published: Jan 24, 2026
- Affected: fixed in 4.0.17.

### [CVE-2025-69200](https://cve.now/CVE-2025-69200): phpMyFAQ has unauthenticated config backup download via /api/setup/backup

- Severity: High 7.5
- Published: Dec 29, 2025
- Affected: fixed in 4.0.16; from 4.1.0-alpha, through 4.1.0-beta.2.

### [CVE-2025-68951](https://cve.now/CVE-2025-68951): phpMyFAQ has stored XSS in admin "List of users" via display\_name HTML entity decoding (html\_entity\_decode) + Twig |raw

- Severity: Medium 5.4
- Published: Dec 29, 2025
- Affected: from 4.0.14, fixed in 4.0.16.

### [CVE-2023-53929](https://cve.now/CVE-2023-53929): phpMyFAQ 3.1.12 CSV Injection via User Profile Export

- Severity: Medium 6.2
- Published: Dec 17, 2025
- Affected: through 3.1.12.

### [CVE-2025-62519](https://cve.now/CVE-2025-62519): phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

- Severity: High 7.2
- Published: Nov 17, 2025
- Affected: fixed in 4.0.14.

### [CVE-2025-59943](https://cve.now/CVE-2025-59943): phpMyFAQ duplicate email registration allows multiple accounts with the same email

- Severity: High 8.1
- Published: Oct 3, 2025
- Affected: from 4.0.7, fixed in 4.0.13.

### [CVE-2024-56199](https://cve.now/CVE-2024-56199): phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

- Severity: Medium 5.2
- Published: Jan 2, 2025
- Affected: from 3.2.10, through 4.0.1.

### [CVE-2024-55889](https://cve.now/CVE-2024-55889): phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

- Severity: Medium 4.9
- Published: Dec 13, 2024
- Affected: fixed in 3.2.10.

### [CVE-2024-54141](https://cve.now/CVE-2024-54141): phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

- Severity: High 8.6
- Published: Dec 6, 2024
- Affected: fixed in 4.0.0.

### [CVE-2023-6890](https://cve.now/CVE-2023-6890): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 5.4
- Published: Dec 16, 2023
- Affected: fixed in 3.1.17.

### [CVE-2023-6889](https://cve.now/CVE-2023-6889): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 5.4
- Published: Dec 16, 2023
- Affected: fixed in 3.1.17.

### [CVE-2023-5866](https://cve.now/CVE-2023-5866): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq

- Severity: Medium 6.3
- Published: Oct 31, 2023
- Affected: fixed in 3.2.1.

### [CVE-2023-5867](https://cve.now/CVE-2023-5867): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.6
- Published: Oct 31, 2023
- Affected: fixed in 3.2.2.

### [CVE-2023-5865](https://cve.now/CVE-2023-5865): Insufficient Session Expiration in thorsten/phpmyfaq

- Severity: High 7.6
- Published: Oct 31, 2023
- Affected: fixed in 3.2.2.

### [CVE-2023-5864](https://cve.now/CVE-2023-5864): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 7.4
- Published: Oct 31, 2023
- Affected: fixed in 3.2.1.

### [CVE-2023-5863](https://cve.now/CVE-2023-5863): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: High 7.4
- Published: Oct 31, 2023
- Affected: fixed in 3.2.2.

### [CVE-2023-5320](https://cve.now/CVE-2023-5320): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

- Severity: Critical 9.0
- Published: Sep 30, 2023
- Affected: fixed in 3.1.18.

### [CVE-2023-5317](https://cve.now/CVE-2023-5317): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 6.3
- Published: Sep 30, 2023
- Affected: fixed in 3.1.18.

### [CVE-2023-5316](https://cve.now/CVE-2023-5316): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

- Severity: Critical 9.1
- Published: Sep 30, 2023
- Affected: fixed in 3.1.18.

### [CVE-2023-5319](https://cve.now/CVE-2023-5319): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Sep 30, 2023
- Affected: fixed in 3.1.18.

### [CVE-2023-5227](https://cve.now/CVE-2023-5227): Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq

- Severity: Medium 6.5
- Published: Sep 30, 2023
- Affected: fixed in 3.1.18.

### [CVE-2023-4007](https://cve.now/CVE-2023-4007): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.8
- Published: Jul 31, 2023
- Affected: fixed in 3.1.16.

### [CVE-2023-4006](https://cve.now/CVE-2023-4006): Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq

- Severity: High 8.8
- Published: Jul 31, 2023
- Affected: fixed in 3.1.16.

### [CVE-2023-3469](https://cve.now/CVE-2023-3469): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: Medium 5.2
- Published: Jun 30, 2023
- Affected: fixed in 3.2.0-beta.2.

### [CVE-2023-2999](https://cve.now/CVE-2023-2999): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 6.7
- Published: May 31, 2023
- Affected: fixed in 3.1.14.

### [CVE-2023-2998](https://cve.now/CVE-2023-2998): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 6.0
- Published: May 31, 2023
- Affected: fixed in 3.1.14.

### [CVE-2023-2753](https://cve.now/CVE-2023-2753): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 7.2
- Published: May 17, 2023
- Affected: fixed in 3.2.0-beta.

### [CVE-2023-2752](https://cve.now/CVE-2023-2752): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 7.2
- Published: May 17, 2023
- Affected: fixed in 3.2.0-beta.

### [CVE-2023-2550](https://cve.now/CVE-2023-2550): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.2
- Published: May 5, 2023
- Affected: fixed in 3.1.13.

### [CVE-2023-2427](https://cve.now/CVE-2023-2427): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: Medium 6.1
- Published: May 5, 2023
- Affected: fixed in 3.1.13.

### [CVE-2023-2429](https://cve.now/CVE-2023-2429): Improper Access Control in thorsten/phpmyfaq

- Severity: Medium 6.6
- Published: Apr 30, 2023
- Affected: fixed in 3.1.13.

### [CVE-2023-2428](https://cve.now/CVE-2023-2428): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 6.1
- Published: Apr 30, 2023
- Affected: fixed in 3.1.13.

### [CVE-2023-1875](https://cve.now/CVE-2023-1875): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 5.4
- Published: Apr 22, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1887](https://cve.now/CVE-2023-1887): Business Logic Errors in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1886](https://cve.now/CVE-2023-1886): Authentication Bypass by Capture-replay in thorsten/phpmyfaq

- Severity: High 7.3
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1885](https://cve.now/CVE-2023-1885): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 6.3
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1884](https://cve.now/CVE-2023-1884): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1883](https://cve.now/CVE-2023-1883): Improper Access Control in thorsten/phpmyfaq

- Severity: Medium 5.4
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1882](https://cve.now/CVE-2023-1882): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1880](https://cve.now/CVE-2023-1880): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1879](https://cve.now/CVE-2023-1879): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1878](https://cve.now/CVE-2023-1878): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1758](https://cve.now/CVE-2023-1758): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

- Severity: High 8.9
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1757](https://cve.now/CVE-2023-1757): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1756](https://cve.now/CVE-2023-1756): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Apr 5, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1762](https://cve.now/CVE-2023-1762): Improper Privilege Management in thorsten/phpmyfaq

- Severity: High 7.2
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1761](https://cve.now/CVE-2023-1761): Cross-site Scripting in thorsten/phpmyfaq

- Severity: Medium 6.3
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1760](https://cve.now/CVE-2023-1760): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1759](https://cve.now/CVE-2023-1759): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1755](https://cve.now/CVE-2023-1755): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

- Severity: High 8.4
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1754](https://cve.now/CVE-2023-1754): Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-1753](https://cve.now/CVE-2023-1753): Weak Password Requirements in thorsten/phpmyfaq

- Severity: Medium 5.5
- Published: Mar 31, 2023
- Affected: fixed in 3.1.12.

### [CVE-2023-0880](https://cve.now/CVE-2023-0880): Misinterpretation of Input in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Feb 17, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0794](https://cve.now/CVE-2023-0794): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0793](https://cve.now/CVE-2023-0793): Weak Password Requirements in thorsten/phpmyfaq

- Severity: High 7.1
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0792](https://cve.now/CVE-2023-0792): Code Injection in thorsten/phpmyfaq

- Severity: Medium 6.5
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0791](https://cve.now/CVE-2023-0791): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.3
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0790](https://cve.now/CVE-2023-0790): Uncaught Exception in thorsten/phpmyfaq

- Severity: High 7.6
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0789](https://cve.now/CVE-2023-0789): Command Injection in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0788](https://cve.now/CVE-2023-0788): Code Injection in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0787](https://cve.now/CVE-2023-0787): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

- Severity: High 8.1
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0786](https://cve.now/CVE-2023-0786): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq

- Severity: High 8.4
- Published: Feb 12, 2023
- Affected: fixed in 3.1.11.

### [CVE-2023-0314](https://cve.now/CVE-2023-0314): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: Medium 6.5
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0313](https://cve.now/CVE-2023-0313): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.7
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0312](https://cve.now/CVE-2023-0312): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.6
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0311](https://cve.now/CVE-2023-0311): Improper Authentication in thorsten/phpmyfaq

- Severity: Medium 5.3
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0310](https://cve.now/CVE-2023-0310): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Critical 9.8
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0309](https://cve.now/CVE-2023-0309): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.6
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0308](https://cve.now/CVE-2023-0308): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 7.6
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0307](https://cve.now/CVE-2023-0307): Weak Password Requirements in thorsten/phpmyfaq

- Severity: Medium 5.7
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2023-0306](https://cve.now/CVE-2023-0306): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Critical 9.1
- Published: Jan 15, 2023
- Affected: fixed in 3.1.10.

### [CVE-2022-4409](https://cve.now/CVE-2022-4409): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq

- Severity: Medium 6.3
- Published: Dec 11, 2022
- Affected: fixed in 3.1.9.

### [CVE-2022-4408](https://cve.now/CVE-2022-4408): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: Medium 4.3
- Published: Dec 11, 2022
- Affected: fixed in 3.1.9.

### [CVE-2022-4407](https://cve.now/CVE-2022-4407): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: Critical 9.8
- Published: Dec 11, 2022
- Affected: fixed in 3.1.9.

### [CVE-2022-3766](https://cve.now/CVE-2022-3766): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

- Severity: High 7.3
- Published: Oct 31, 2022
- Affected: fixed in 3.1.8.

### [CVE-2022-3765](https://cve.now/CVE-2022-3765): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 8.2
- Published: Oct 31, 2022
- Affected: fixed in 3.1.8.

### [CVE-2022-3754](https://cve.now/CVE-2022-3754): Weak Password Requirements in thorsten/phpmyfaq

- Severity: High 7.5
- Published: Oct 29, 2022
- Affected: fixed in 3.1.8.

### [CVE-2022-3608](https://cve.now/CVE-2022-3608): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

- Severity: High 7.2
- Published: Oct 19, 2022
- Affected: fixed in 3.2.0-alpha.

### [CVE-2018-16650](https://cve.now/CVE-2018-16650): phpMyFAQ before 2.9.11 allows CSRF.

- Severity: Unrated
- Published: Sep 7, 2018
- Affected: fixed in 2.9.11.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/thorsten/phpmyfaq
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.