Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-rw77-vq4g-x3hp
  • Packagist/phpmyfaq/phpmyfaq
  • Packagist/thorsten/phpmyfaq
 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion 24 Sep
  • Fix available
  • Severity - 8.5 (High)
GHSA-8gpw-xvpf-hvx5
  • Packagist/phpmyfaq/phpmyfaq
  • Packagist/thorsten/phpmyfaq
 phpMyFAQ's two-factor authentication login bypasses the password factor 24 Sep
  • Fix available
  • Severity - 8.1 (High)
GHSA-pgwp-vc7q-cvj3
  • Packagist/phpmyfaq/phpmyfaq
  • Packagist/thorsten/phpmyfaq
 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission 24 Sep
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-47132
  • github.com/thorsten/phpmyfaq
 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration 24 Sep
  • Fix available
  • Severity - 5.4 (Medium)
CVE-2026-56738
  • github.com/thorsten/phpmyfaq
 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion 24 Sep
  • Fix available
  • Severity - 8.5 (High)
CVE-2026-56737
  • github.com/thorsten/phpmyfaq
 phpMyFAQ's two-factor authentication login bypasses the password factor 24 Sep
  • Fix available
  • Severity - 8.1 (High)
CVE-2026-56736
  • github.com/thorsten/phpmyfaq
 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission 24 Sep
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-85593
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode 04 Sep
  • Fix available
  • Severity - 5.1 (Medium)
CVE-2026-85592
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 Authorization Bypass via question/create 04 Sep
  • Fix available
  • Severity - 6.3 (Medium)
CVE-2026-85591
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change 04 Sep
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-85590
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable 04 Sep
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-85589
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API 04 Sep
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-85588
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export 04 Sep
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-85587
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages 04 Sep
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-85586
  • github.com/thorsten/phpmyfaq
 phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter 04 Sep
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-pg62-f8g4-4wqh
  • Packagist/phpmyfaq/phpmyfaq
  • Packagist/thorsten/phpmyfaq
 phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold 25 Aug
  • Fix available
  • Severity - 8.8 (High)
Load more...