Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

phpMyFAQ — Vulnerabilities & Security Advisories 83

All 83 CVE vulnerabilities found in phpMyFAQ, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product phpMyFAQ, focusing on the software's security history. It collects and indexes known security flaws affecting this specific open-source FAQ management tool, covering the time period from its initial release through the most recent advisory updates. Readers can use this interface to track vendor security advisories, understand common weakness classes such as cross-site scripting or SQL injection, and review the complete vulnerability history of the product. The aggregated data helps security teams and auditors quickly identify recurring issues, monitor the vendor's patching frequency, and correlate weaknesses across different versions of phpMyFAQ without manually searching individual bug reports.

Vendor: thorsten

CVE ID Title CVSS Severity Published
CVE-2026-27836 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint CWE-862 7.5 High 2026-02-27
CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions CWE-200 5.3 Medium 2026-01-24
CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) CWE-284 6.5 Medium 2026-01-24
CVE-2026-24421 phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user CWE-862 6.5 Medium 2026-01-24
CVE-2025-69200 phpMyFAQ has unauthenticated config backup download via /api/setup/backup CWE-202 7.5 High 2025-12-29
CVE-2025-68951 phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw CWE-79 5.4 Medium 2025-12-29
CVE-2023-53929 phpMyFAQ 3.1.12 CSV Injection via User Profile Export CWE-1236 8.8 High 2025-12-17
CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality CWE-89 7.2 High 2025-11-17
CVE-2025-59943 phpMyFAQ duplicate email registration allows multiple accounts with the same email CWE-286 8.1 High 2025-10-03
CVE-2024-56199 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ CWE-79 5.2 Medium 2025-01-02
CVE-2024-55889 phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames CWE-451 4.9 Medium 2024-12-13
CVE-2024-54141 phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available CWE-209 8.6 High 2024-12-06
CVE-2024-29196 phpMyFAQ Path Traversal in Attachments CWE-22 3.8 Low 2024-03-26
CVE-2024-29179 phpMyFAQ Stored Cross-site Scripting at File Attachments CWE-79 4.8AI Medium AI 2024-03-25
CVE-2024-28108 phpMyFAQ Stored HTML Injection at contentLink CWE-79 4.7 Medium 2024-03-25
CVE-2024-28107 phpMyFAQ SQL injections at insertentry & saveentry CWE-89 8.8 High 2024-03-25
CVE-2024-28106 phpMyFAQ Stored XSS at FAQ News Content CWE-79 4.3 Medium 2024-03-25
CVE-2024-28105 phpMyFAQ's File Upload Bypass at Category Image Leads to RCE CWE-434 7.2 High 2024-03-25
CVE-2024-27300 phpMyFAQ Stored XSS at user email CWE-79 5.5 Medium 2024-03-25
CVE-2024-27299 phpMyFAQ SQL Injection at "Save News" CWE-89 8.8 High 2024-03-25
CVE-2024-24574 phpMyFAQ vulnerable to stored XSS on attachments filename CWE-79 6.5 Medium 2024-02-05
CVE-2024-22208 phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes CWE-863 6.5 Medium 2024-02-05
CVE-2024-22202 User Removal Page Allows Spoofing Of User Details CWE-284 5.7 Medium 2024-02-05

All 83 known CVE vulnerabilities affecting phpMyFAQ with full Chinese analysis, references, and POCs where available.