Thorsten vulnerabilities
178 CVEs and advisories name Thorsten as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-66399phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership
- CVE-2026-66398phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
- CVE-2026-66397phpMyFAQ before 4.1.6 Path Traversal via category image deletion
- CVE-2026-49205phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
- CVE-2026-48488phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
- CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint
- CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
- CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API Token
- CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password API
- CVE-2026-46367phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering
- CVE-2026-46366phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass
- CVE-2026-46365phpMyFAQ - Missing Authorization in Tag Deletion Endpoint
- CVE-2026-46364phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
- CVE-2026-46363phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass
- CVE-2026-46362phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
- CVE-2026-46361phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig
- CVE-2026-46360phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer
- CVE-2026-46359phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields
- CVE-2026-45010phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint
- CVE-2026-45009phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
- CVE-2026-45008phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter
- CVE-2026-45007phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure
- CVE-2026-34974phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation
- CVE-2026-34973phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
- CVE-2026-34729phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
- CVE-2026-34728phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
- CVE-2026-32629phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor
- CVE-2026-27836phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
- CVE-2026-24422phpMyFAQ: Public API endpoints expose emails and invisible questions
- CVE-2026-24420phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)