Thorsten vulnerabilities
178 CVEs and advisories name Thorsten as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
- CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks
- CVE-2026-109573phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
- CVE-2026-108851phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
- CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
- CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
- CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factor
- CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
- CVE-2026-85593phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
- CVE-2026-85592phpMyFAQ before 4.1.8 Authorization Bypass via question/create
- CVE-2026-85591phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
- CVE-2026-85590phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
- CVE-2026-85589phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
- CVE-2026-85588phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
- CVE-2026-85587phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
- CVE-2026-85586phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
- CVE-2026-76215phpMyFAQ before 4.1.7 Missing Authorization via child resources
- CVE-2026-76214phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
- CVE-2026-76213phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
- CVE-2026-76212phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
- CVE-2026-76211phpMyFAQ before 4.1.7 Information Disclosure via Admin API
- CVE-2026-76210phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
- CVE-2026-76209phpMyFAQ before v4.1.6 Registration Bypass via API
- CVE-2026-76208phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
- CVE-2026-76207phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
- CVE-2026-76206phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
- CVE-2026-76205phpMyFAQ before 4.1.7 SQL Injection via Glossary
- CVE-2026-75920phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
- CVE-2026-75919phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
- CVE-2026-75918phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File