Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 221

Export CSV
CVE-2026-124433

phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privileged groups. Attackers can submit a target group_list_select value to /admin/group/confirm and then /admin/group/delete to remove privileged groups, their memberships, and permission mappings.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2026-116182

phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in generated PDFs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq
CVE-2026-32629

phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "<script>alert(1)</script>"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-116183

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-34729

phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111910

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111905

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111900

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111894

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111904

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111901

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111902

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111906

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111907

phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111908

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111909

phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111911

phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111903

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111889

phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111897

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq
Products
Phpmyfaq