Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

phpMyFAQ — Vulnerabilities & Security Advisories 83

All 83 CVE vulnerabilities found in phpMyFAQ, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product phpMyFAQ, focusing on the software's security history. It collects and indexes known security flaws affecting this specific open-source FAQ management tool, covering the time period from its initial release through the most recent advisory updates. Readers can use this interface to track vendor security advisories, understand common weakness classes such as cross-site scripting or SQL injection, and review the complete vulnerability history of the product. The aggregated data helps security teams and auditors quickly identify recurring issues, monitor the vendor's patching frequency, and correlate weaknesses across different versions of phpMyFAQ without manually searching individual bug reports.

Vendor: thorsten

CVE ID Title CVSS Severity Published
CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion CWE-22 8.6 High 2026-07-27
CVE-2026-57996 phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint CWE-269 8.8 High 2026-07-15
CVE-2026-57994 phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints CWE-200 5.3 Medium 2026-07-10
CVE-2026-57961 phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function CWE-22 2.7 Low 2026-07-10
CVE-2026-57995 phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions CWE-269 8.8 High 2026-06-30
CVE-2026-56396 phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() CWE-862 8.8 High 2026-06-21
CVE-2026-49205 phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) CWE-862 6.5 Medium 2026-06-18
CVE-2026-48488 phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing CWE-328 - - 2026-06-08
CVE-2026-35676 phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint CWE-640 8.2 High 2026-05-28
CVE-2026-35672 phpMyFAQ - Authentication Bypass via Empty API Token CWE-1188 7.5 High 2026-05-28
CVE-2026-35675 phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update CWE-307 8.2 High 2026-05-28
CVE-2026-35671 phpMyFAQ - Insecure Direct Object Reference in User Password API CWE-266 8.8 High 2026-05-28
CVE-2026-46367 phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering CWE-79 7.6 High 2026-05-15
CVE-2026-46366 phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass CWE-863 7.5 High 2026-05-15
CVE-2026-46365 phpMyFAQ - Missing Authorization in Tag Deletion Endpoint CWE-862 5.4 Medium 2026-05-15
CVE-2026-46364 phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha CWE-89 9.8 Critical 2026-05-15
CVE-2026-46363 phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass CWE-79 5.4 Medium 2026-05-15
CVE-2026-46362 phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check CWE-863 6.5 Medium 2026-05-15
CVE-2026-46361 phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig CWE-79 6.9 Medium 2026-05-15
CVE-2026-46360 phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer CWE-79 5.4 Medium 2026-05-15
CVE-2026-46359 phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields CWE-89 7.5 High 2026-05-15
CVE-2026-45010 phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint CWE-307 9.1 Critical 2026-05-15
CVE-2026-45009 phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints CWE-863 4.3 Medium 2026-05-15
CVE-2026-45008 phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter CWE-73 6.5 Medium 2026-05-15
CVE-2026-45007 phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure CWE-862 4.3 Medium 2026-05-15
CVE-2026-34974 phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation CWE-79 5.4 Medium 2026-04-02
CVE-2026-34973 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure CWE-943 8.2AI High AI 2026-04-02
CVE-2026-34729 phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() CWE-79 6.1 Medium 2026-04-02
CVE-2026-34728 phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController CWE-22 8.7 High 2026-04-02
CVE-2026-32629 phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor CWE-20 6.1AI Medium AI 2026-04-02

All 83 known CVE vulnerabilities affecting phpMyFAQ with full Chinese analysis, references, and POCs where available.