Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

phpMyFAQ — Vulnerabilities & Security Advisories 83

All 83 CVE vulnerabilities found in phpMyFAQ, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product phpMyFAQ, focusing on the software's security history. It collects and indexes known security flaws affecting this specific open-source FAQ management tool, covering the time period from its initial release through the most recent advisory updates. Readers can use this interface to track vendor security advisories, understand common weakness classes such as cross-site scripting or SQL injection, and review the complete vulnerability history of the product. The aggregated data helps security teams and auditors quickly identify recurring issues, monitor the vendor's patching frequency, and correlate weaknesses across different versions of phpMyFAQ without manually searching individual bug reports.

Vendor: thorsten

CVE ID Title CVSS Severity Published
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint CWE-89 8.1 High 2026-10-12
CVE-2026-108851 phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool CWE-862 3.3 Low 2026-10-11
CVE-2026-47132 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration CWE-20 5.4 Medium 2026-09-24
CVE-2026-56738 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion CWE-89 8.5 High 2026-09-24
CVE-2026-56737 phpMyFAQ's two-factor authentication login bypasses the password factor CWE-287 8.1 High 2026-09-24
CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission CWE-79 8.2 High 2026-09-24
CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode CWE-79 5.4 Medium 2026-09-04
CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create CWE-863 3.7 Low 2026-09-04
CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change CWE-620 7.1 High 2026-09-04
CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable CWE-308 7.1 High 2026-09-04
CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API CWE-862 5.3 Medium 2026-09-04
CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export CWE-200 5.3 Medium 2026-09-04
CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages CWE-863 5.3 Medium 2026-09-04
CVE-2026-85586 phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter CWE-799 6.9 Medium 2026-09-04
CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources CWE-862 5.3 Medium 2026-08-19
CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge CWE-294 7.4 High 2026-08-19
CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL CWE-88 5.3 Medium 2026-08-19
CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle CWE-307 7.4 High 2026-08-19
CVE-2026-76211 phpMyFAQ before 4.1.7 Information Disclosure via Admin API CWE-862 4.3 Medium 2026-08-19
CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export CWE-73 6.5 Medium 2026-08-19
CVE-2026-76209 phpMyFAQ before v4.1.6 Registration Bypass via API CWE-862 4.3 Medium 2026-08-19
CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP CWE-778 8.2 High 2026-08-19
CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie CWE-304 8.1 High 2026-08-19
CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export CWE-200 5.3 Medium 2026-08-19
CVE-2026-76205 phpMyFAQ before 4.1.7 SQL Injection via Glossary CWE-89 8.1 High 2026-08-19
CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP CWE-377 5.3 Medium 2026-08-19
CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API CWE-306 5.3 Medium 2026-08-19
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File CWE-200 8.8 High 2026-08-19
CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership CWE-269 6.5 Medium 2026-07-27
CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API CWE-494 9.4 Critical 2026-07-27

All 83 known CVE vulnerabilities affecting phpMyFAQ with full Chinese analysis, references, and POCs where available.