# cve.now: Thorsten

The newest entries naming Thorsten as an affected vendor (up to 200), of 178 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124433](https://cve.now/CVE-2026-124433.md): phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController (CVSS 7.0)
- [CVE-2026-124432](https://cve.now/CVE-2026-124432.md): phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login (CVSS 6.9)
- [CVE-2026-116183](https://cve.now/CVE-2026-116183.md): phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID (CVSS 8.7)
- [CVE-2026-116182](https://cve.now/CVE-2026-116182.md): phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching (CVSS 5.3)
- [CVE-2026-111911](https://cve.now/CVE-2026-111911.md): phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection (CVSS 9.3)
- [CVE-2026-111910](https://cve.now/CVE-2026-111910.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads (CVSS 7.1)
- [CVE-2026-111909](https://cve.now/CVE-2026-111909.md): phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API (CVSS 7.2)
- [CVE-2026-111908](https://cve.now/CVE-2026-111908.md): phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API (CVSS 8.7)
- [CVE-2026-111907](https://cve.now/CVE-2026-111907.md): phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database (CVSS 7.1)
- [CVE-2026-111906](https://cve.now/CVE-2026-111906.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations (CVSS 7.1)
- [CVE-2026-111905](https://cve.now/CVE-2026-111905.md): phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data (CVSS 7.0)
- [CVE-2026-111904](https://cve.now/CVE-2026-111904.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API (CVSS 6.9)
- [CVE-2026-111903](https://cve.now/CVE-2026-111903.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass (CVSS 5.1)
- [CVE-2026-111902](https://cve.now/CVE-2026-111902.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API (CVSS 6.9)
- [CVE-2026-111901](https://cve.now/CVE-2026-111901.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination (CVSS 8.7)
- [CVE-2026-111900](https://cve.now/CVE-2026-111900.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php (CVSS 5.3)
- [CVE-2026-111898](https://cve.now/CVE-2026-111898.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking (CVSS 7.7)
- [CVE-2026-111897](https://cve.now/CVE-2026-111897.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints (CVSS 7.1)
- [CVE-2026-111896](https://cve.now/CVE-2026-111896.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass (CVSS 5.1)
- [CVE-2026-111895](https://cve.now/CVE-2026-111895.md): phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred\_username (CVSS 7.6)
- [CVE-2026-111894](https://cve.now/CVE-2026-111894.md): phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI (CVSS 5.1)
- [CVE-2026-111893](https://cve.now/CVE-2026-111893.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API (CVSS 8.5)
- [CVE-2026-111892](https://cve.now/CVE-2026-111892.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints (CVSS 6.9)
- [CVE-2026-111891](https://cve.now/CVE-2026-111891.md): phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API (CVSS 7.0)
- [CVE-2026-111890](https://cve.now/CVE-2026-111890.md): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights (CVSS 7.0)
- [CVE-2026-111889](https://cve.now/CVE-2026-111889.md): phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard (CVSS 5.3)
- [CVE-2026-111888](https://cve.now/CVE-2026-111888.md): phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API (CVSS 5.1)
- [CVE-2026-111887](https://cve.now/CVE-2026-111887.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint (CVSS 6.9)
- [CVE-2026-111886](https://cve.now/CVE-2026-111886.md): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint (CVSS 7.1)
- [CVE-2026-111885](https://cve.now/CVE-2026-111885.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API (CVSS 7.0)
- [CVE-2026-111884](https://cve.now/CVE-2026-111884.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover (CVSS 8.7)
- [CVE-2026-111882](https://cve.now/CVE-2026-111882.md): phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks (CVSS 8.6)
- [CVE-2026-109573](https://cve.now/CVE-2026-109573.md): phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint (CVSS 9.2)
- [CVE-2026-108851](https://cve.now/CVE-2026-108851.md): phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq\_search Tool (CVSS 4.8)
- [CVE-2026-47132](https://cve.now/CVE-2026-47132.md): phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration (CVSS 5.4)
- [CVE-2026-56738](https://cve.now/CVE-2026-56738.md): phpMyFAQ has SQL Injection in \`StopWords::add()\` — Unescaped Stop Word Insertion (CVSS 8.5)
- [CVE-2026-56737](https://cve.now/CVE-2026-56737.md): phpMyFAQ's two-factor authentication login bypasses the password factor (CVSS 8.1)
- [CVE-2026-56736](https://cve.now/CVE-2026-56736.md): phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission (CVSS 8.2)
- [CVE-2026-85593](https://cve.now/CVE-2026-85593.md): phpMyFAQ before 4.1.8 Stored XSS via html\_entity\_decode (CVSS 5.1)
- [CVE-2026-85592](https://cve.now/CVE-2026-85592.md): phpMyFAQ before 4.1.8 Authorization Bypass via question/create (CVSS 6.3)
- [CVE-2026-85591](https://cve.now/CVE-2026-85591.md): phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change (CVSS 7.1)
- [CVE-2026-85590](https://cve.now/CVE-2026-85590.md): phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable (CVSS 7.1)
- [CVE-2026-85589](https://cve.now/CVE-2026-85589.md): phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API (CVSS 5.3)
- [CVE-2026-85588](https://cve.now/CVE-2026-85588.md): phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export (CVSS 5.3)
- [CVE-2026-85587](https://cve.now/CVE-2026-85587.md): phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages (CVSS 5.3)
- [CVE-2026-85586](https://cve.now/CVE-2026-85586.md): phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter (CVSS 6.9)
- [CVE-2026-76215](https://cve.now/CVE-2026-76215.md): phpMyFAQ before 4.1.7 Missing Authorization via child resources (CVSS 6.9)
- [CVE-2026-76214](https://cve.now/CVE-2026-76214.md): phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge (CVSS 9.1)
- [CVE-2026-76213](https://cve.now/CVE-2026-76213.md): phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle (CVSS 9.1)
- [CVE-2026-76212](https://cve.now/CVE-2026-76212.md): phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL (CVSS 6.9)
- [CVE-2026-76211](https://cve.now/CVE-2026-76211.md): phpMyFAQ before 4.1.7 Information Disclosure via Admin API (CVSS 5.3)
- [CVE-2026-76210](https://cve.now/CVE-2026-76210.md): phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export (CVSS 7.1)
- [CVE-2026-76209](https://cve.now/CVE-2026-76209.md): phpMyFAQ before v4.1.6 Registration Bypass via API (CVSS 5.3)
- [CVE-2026-76208](https://cve.now/CVE-2026-76208.md): phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP (CVSS 8.8)
- [CVE-2026-76207](https://cve.now/CVE-2026-76207.md): phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie (CVSS 8.6)
- [CVE-2026-76206](https://cve.now/CVE-2026-76206.md): phpMyFAQ before 4.1.7 Information Disclosure via PDF Export (CVSS 6.9)
- [CVE-2026-76205](https://cve.now/CVE-2026-76205.md): phpMyFAQ before 4.1.7 SQL Injection via Glossary (CVSS 8.6)
- [CVE-2026-75920](https://cve.now/CVE-2026-75920.md): phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP (CVSS 6.0)
- [CVE-2026-75919](https://cve.now/CVE-2026-75919.md): phpMyFAQ before 4.1.7 Authentication Bypass via Setup API (CVSS 6.9)
- [CVE-2026-75918](https://cve.now/CVE-2026-75918.md): phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File (CVSS 8.7)
- [CVE-2026-66399](https://cve.now/CVE-2026-66399.md): phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership (CVSS 8.5)
- [CVE-2026-66398](https://cve.now/CVE-2026-66398.md): phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API (CVSS 9.4)
- [CVE-2026-66397](https://cve.now/CVE-2026-66397.md): phpMyFAQ before 4.1.6 Path Traversal via category image deletion (CVSS 8.6)
- [CVE-2026-49205](https://cve.now/CVE-2026-49205.md): phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) (CVSS 6.5)
- [CVE-2026-48488](https://cve.now/CVE-2026-48488.md): phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing (CVSS 2.7)
- [CVE-2026-35676](https://cve.now/CVE-2026-35676.md): phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint (CVSS 8.2)
- [CVE-2026-35675](https://cve.now/CVE-2026-35675.md): phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update (CVSS 8.2)
- [CVE-2026-35672](https://cve.now/CVE-2026-35672.md): phpMyFAQ - Authentication Bypass via Empty API Token (CVSS 7.5)
- [CVE-2026-35671](https://cve.now/CVE-2026-35671.md): phpMyFAQ - Insecure Direct Object Reference in User Password API (CVSS 8.8)
- [CVE-2026-46367](https://cve.now/CVE-2026-46367.md): phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering (CVSS 7.6)
- [CVE-2026-46366](https://cve.now/CVE-2026-46366.md): phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass (CVSS 7.5)
- [CVE-2026-46365](https://cve.now/CVE-2026-46365.md): phpMyFAQ - Missing Authorization in Tag Deletion Endpoint (CVSS 5.4)
- [CVE-2026-46364](https://cve.now/CVE-2026-46364.md): phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha (CVSS 9.8)
- [CVE-2026-46363](https://cve.now/CVE-2026-46363.md): phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass (CVSS 5.4)
- [CVE-2026-46362](https://cve.now/CVE-2026-46362.md): phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check (CVSS 6.5)
- [CVE-2026-46361](https://cve.now/CVE-2026-46361.md): phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig (CVSS 6.9)
- [CVE-2026-46360](https://cve.now/CVE-2026-46360.md): phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer (CVSS 5.4)
- [CVE-2026-46359](https://cve.now/CVE-2026-46359.md): phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields (CVSS 7.5)
- [CVE-2026-45010](https://cve.now/CVE-2026-45010.md): phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint (CVSS 9.1)
- [CVE-2026-45009](https://cve.now/CVE-2026-45009.md): phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints (CVSS 4.3)
- [CVE-2026-45008](https://cve.now/CVE-2026-45008.md): phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter (CVSS 6.5)
- [CVE-2026-45007](https://cve.now/CVE-2026-45007.md): phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure (CVSS 4.3)
- [CVE-2026-34974](https://cve.now/CVE-2026-34974.md): phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation (CVSS 5.4)
- [CVE-2026-34973](https://cve.now/CVE-2026-34973.md): phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and \_ Metacharacters Enable Broad Content Disclosure (CVSS 6.9)
- [CVE-2026-34729](https://cve.now/CVE-2026-34729.md): phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() (CVSS 6.1)
- [CVE-2026-34728](https://cve.now/CVE-2026-34728.md): phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController (CVSS 8.7)
- [CVE-2026-32629](https://cve.now/CVE-2026-32629.md): phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor (CVSS 5.4)
- [CVE-2026-27836](https://cve.now/CVE-2026-27836.md): phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint (CVSS 7.5)
- [CVE-2026-24422](https://cve.now/CVE-2026-24422.md): phpMyFAQ: Public API endpoints expose emails and invisible questions (CVSS 5.3)
- [CVE-2026-24420](https://cve.now/CVE-2026-24420.md): phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) (CVSS 6.5)
- [CVE-2026-24421](https://cve.now/CVE-2026-24421.md): phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user (CVSS 6.5)
- [CVE-2025-69200](https://cve.now/CVE-2025-69200.md): phpMyFAQ has unauthenticated config backup download via /api/setup/backup (CVSS 7.5)
- [CVE-2025-68951](https://cve.now/CVE-2025-68951.md): phpMyFAQ has stored XSS in admin "List of users" via display\_name HTML entity decoding (html\_entity\_decode) + Twig |raw (CVSS 5.4)
- [CVE-2025-62519](https://cve.now/CVE-2025-62519.md): phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality (CVSS 7.2)
- [CVE-2025-59943](https://cve.now/CVE-2025-59943.md): phpMyFAQ duplicate email registration allows multiple accounts with the same email (CVSS 8.1)
- [CVE-2024-56199](https://cve.now/CVE-2024-56199.md): phpMyFAQ Vulnerable to Stored HTML Injection at FAQ (CVSS 5.2)
- [CVE-2024-55889](https://cve.now/CVE-2024-55889.md): phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames (CVSS 4.9)
- [CVE-2024-54141](https://cve.now/CVE-2024-54141.md): phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available (CVSS 8.6)
- [CVE-2024-29196](https://cve.now/CVE-2024-29196.md): phpMyFAQ Path Traversal in Attachments (CVSS 3.8)
- [CVE-2024-29179](https://cve.now/CVE-2024-29179.md): phpMyFAQ Stored Cross-site Scripting at File Attachments (CVSS 4.3)
- [CVE-2024-28108](https://cve.now/CVE-2024-28108.md): phpMyFAQ Stored HTML Injection at contentLink (CVSS 4.7)
- [CVE-2024-28107](https://cve.now/CVE-2024-28107.md): phpMyFAQ SQL injections at insertentry & saveentry (CVSS 8.8)
- [CVE-2024-28106](https://cve.now/CVE-2024-28106.md): phpMyFAQ Stored XSS at FAQ News Content (CVSS 4.3)
- [CVE-2024-28105](https://cve.now/CVE-2024-28105.md): phpMyFAQ's File Upload Bypass at Category Image Leads to RCE (CVSS 7.2)
- [CVE-2024-27300](https://cve.now/CVE-2024-27300.md): phpMyFAQ Stored XSS at user email (CVSS 5.5)
- [CVE-2024-27299](https://cve.now/CVE-2024-27299.md): phpMyFAQ SQL Injection at "Save News" (CVSS 8.8)
- [CVE-2024-24574](https://cve.now/CVE-2024-24574.md): phpMyFAQ vulnerable to stored XSS on attachments filename (CVSS 6.5)
- [CVE-2024-22208](https://cve.now/CVE-2024-22208.md): phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes (CVSS 6.5)
- [CVE-2024-22202](https://cve.now/CVE-2024-22202.md): User Removal Page Allows Spoofing Of User Details (CVSS 5.7)
- [CVE-2023-6890](https://cve.now/CVE-2023-6890.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 5.4)
- [CVE-2023-6889](https://cve.now/CVE-2023-6889.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 5.4)
- [CVE-2023-5866](https://cve.now/CVE-2023-5866.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq (CVSS 6.3)
- [CVE-2023-5867](https://cve.now/CVE-2023-5867.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.6)
- [CVE-2023-5865](https://cve.now/CVE-2023-5865.md): Insufficient Session Expiration in thorsten/phpmyfaq (CVSS 7.6)
- [CVE-2023-5864](https://cve.now/CVE-2023-5864.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.4)
- [CVE-2023-5863](https://cve.now/CVE-2023-5863.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 7.4)
- [CVE-2023-5320](https://cve.now/CVE-2023-5320.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 9.0)
- [CVE-2023-5317](https://cve.now/CVE-2023-5317.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.3)
- [CVE-2023-5316](https://cve.now/CVE-2023-5316.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 9.1)
- [CVE-2023-5319](https://cve.now/CVE-2023-5319.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-5227](https://cve.now/CVE-2023-5227.md): Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq (CVSS 6.5)
- [CVE-2023-4007](https://cve.now/CVE-2023-4007.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.8)
- [CVE-2023-4006](https://cve.now/CVE-2023-4006.md): Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq (CVSS 8.8)
- [CVE-2023-3469](https://cve.now/CVE-2023-3469.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 5.2)
- [CVE-2023-2999](https://cve.now/CVE-2023-2999.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.7)
- [CVE-2023-2998](https://cve.now/CVE-2023-2998.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.0)
- [CVE-2023-2753](https://cve.now/CVE-2023-2753.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2)
- [CVE-2023-2752](https://cve.now/CVE-2023-2752.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2)
- [CVE-2023-2550](https://cve.now/CVE-2023-2550.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.2)
- [CVE-2023-2427](https://cve.now/CVE-2023-2427.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 6.1)
- [CVE-2023-2429](https://cve.now/CVE-2023-2429.md): Improper Access Control in thorsten/phpmyfaq (CVSS 6.6)
- [CVE-2023-2428](https://cve.now/CVE-2023-2428.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.1)
- [CVE-2023-1875](https://cve.now/CVE-2023-1875.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 5.4)
- [CVE-2023-1887](https://cve.now/CVE-2023-1887.md): Business Logic Errors in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-1886](https://cve.now/CVE-2023-1886.md): Authentication Bypass by Capture-replay in thorsten/phpmyfaq (CVSS 7.3)
- [CVE-2023-1885](https://cve.now/CVE-2023-1885.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 6.3)
- [CVE-2023-1884](https://cve.now/CVE-2023-1884.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-1883](https://cve.now/CVE-2023-1883.md): Improper Access Control in thorsten/phpmyfaq (CVSS 5.4)
- [CVE-2023-1882](https://cve.now/CVE-2023-1882.md): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-1880](https://cve.now/CVE-2023-1880.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-1879](https://cve.now/CVE-2023-1879.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-1878](https://cve.now/CVE-2023-1878.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-1758](https://cve.now/CVE-2023-1758.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq (CVSS 8.9)
- [CVE-2023-1757](https://cve.now/CVE-2023-1757.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-1756](https://cve.now/CVE-2023-1756.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-1762](https://cve.now/CVE-2023-1762.md): Improper Privilege Management in thorsten/phpmyfaq (CVSS 7.2)
- [CVE-2023-1761](https://cve.now/CVE-2023-1761.md): Cross-site Scripting in thorsten/phpmyfaq (CVSS 6.3)
- [CVE-2023-1760](https://cve.now/CVE-2023-1760.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-1759](https://cve.now/CVE-2023-1759.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-1755](https://cve.now/CVE-2023-1755.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 8.4)
- [CVE-2023-1754](https://cve.now/CVE-2023-1754.md): Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-1753](https://cve.now/CVE-2023-1753.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 5.5)
- [CVE-2023-0880](https://cve.now/CVE-2023-0880.md): Misinterpretation of Input in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-0794](https://cve.now/CVE-2023-0794.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-0793](https://cve.now/CVE-2023-0793.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 7.1)
- [CVE-2023-0792](https://cve.now/CVE-2023-0792.md): Code Injection in thorsten/phpmyfaq (CVSS 6.5)
- [CVE-2023-0791](https://cve.now/CVE-2023-0791.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.3)
- [CVE-2023-0790](https://cve.now/CVE-2023-0790.md): Uncaught Exception in thorsten/phpmyfaq (CVSS 7.6)
- [CVE-2023-0789](https://cve.now/CVE-2023-0789.md): Command Injection in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-0788](https://cve.now/CVE-2023-0788.md): Code Injection in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-0787](https://cve.now/CVE-2023-0787.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 8.1)
- [CVE-2023-0786](https://cve.now/CVE-2023-0786.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 8.4)
- [CVE-2023-0314](https://cve.now/CVE-2023-0314.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 6.5)
- [CVE-2023-0313](https://cve.now/CVE-2023-0313.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7)
- [CVE-2023-0312](https://cve.now/CVE-2023-0312.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.6)
- [CVE-2023-0311](https://cve.now/CVE-2023-0311.md): Improper Authentication in thorsten/phpmyfaq (CVSS 5.3)
- [CVE-2023-0310](https://cve.now/CVE-2023-0310.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 9.8)
- [CVE-2023-0309](https://cve.now/CVE-2023-0309.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.6)
- [CVE-2023-0308](https://cve.now/CVE-2023-0308.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.6)
- [CVE-2023-0307](https://cve.now/CVE-2023-0307.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 5.7)
- [CVE-2023-0306](https://cve.now/CVE-2023-0306.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 9.1)
- [CVE-2022-4409](https://cve.now/CVE-2022-4409.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in thorsten/phpmyfaq (CVSS 6.3)
- [CVE-2022-4408](https://cve.now/CVE-2022-4408.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.3)
- [CVE-2022-4407](https://cve.now/CVE-2022-4407.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 9.8)
- [CVE-2022-3766](https://cve.now/CVE-2022-3766.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 7.3)
- [CVE-2022-3765](https://cve.now/CVE-2022-3765.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.2)
- [CVE-2022-3754](https://cve.now/CVE-2022-3754.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 7.5)
- [CVE-2022-3608](https://cve.now/CVE-2022-3608.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/thorsten
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.