Thorsten vulnerabilities
178 CVEs and advisories name Thorsten as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController
- CVE-2026-124432phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login
- CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
- CVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
- CVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
- CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
- CVE-2026-111909phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
- CVE-2026-111908phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
- CVE-2026-111907phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
- CVE-2026-111906phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
- CVE-2026-111905phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
- CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
- CVE-2026-111903phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
- CVE-2026-111902phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
- CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
- CVE-2026-111900phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
- CVE-2026-111898phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
- CVE-2026-111897phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
- CVE-2026-111896phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
- CVE-2026-111895phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username
- CVE-2026-111894phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
- CVE-2026-111893phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
- CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
- CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API
- CVE-2026-111890phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights
- CVE-2026-111889phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
- CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
- CVE-2026-111887phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
- CVE-2026-111886phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
- CVE-2026-111885phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API