[HIGH] phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

PKSA-hycs-5t33-gw1y GHSA-pg62-f8g4-4wqh

Affected version: <=4.1.4

Reported by:
GitHub

[MEDIUM] phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

PKSA-cz4f-38kk-4ywj CVE-2026-47132 GHSA-6pvm-2vjj-rx4w

Affected version: <4.2.0-alpha

Reported by:
GitHub

[HIGH] phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

PKSA-bgmm-r5q1-dvfj GHSA-985r-q3qp-299h

Affected version: <=4.1.3

Reported by:
GitHub

[MEDIUM] phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

PKSA-wn7x-tbkv-cqqp CVE-2026-49205 GHSA-8c6h-7g6x-m5x4

Affected version: <4.1.4

Reported by:
GitHub

[LOW] phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

PKSA-p1ky-vdyf-6r6j CVE-2026-48488 GHSA-58fg-62fg-3fcj

Affected version: <=4.1.3

Reported by:
GitHub

[HIGH] phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

PKSA-x1b3-f9q9-1brm CVE-2026-35675 GHSA-w9xh-5f39-vq89

Affected version: <4.1.3

Reported by:
GitHub

[HIGH] phpMyFAQ: Default Empty API Token Authentication Bypass

PKSA-jk8b-rmby-gztg CVE-2026-35672 GHSA-gp95-j463-vv28

Affected version: <=4.1.2

Reported by:
GitHub

[HIGH] phpMyFAQ: IDOR Account Takeover

PKSA-ttcw-fg74-jv2w CVE-2026-35671 GHSA-xvp4-phqj-cjr3

Affected version: <4.1.3

Reported by:
GitHub

[HIGH] phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

PKSA-64xv-jbdm-pg2q CVE-2026-35676 GHSA-9qv9-8xv6-5p35

Affected version: <4.1.3

Reported by:
GitHub

[CRITICAL] phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

PKSA-trv8-7xnx-t8d9 CVE-2026-46364 GHSA-289f-fq7w-6q2w

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

PKSA-djzh-dx9x-j5hd CVE-2026-45008 GHSA-gh9p-q46p-57g2

Affected version: <=4.1.1

Reported by:
GitHub

[HIGH] phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

PKSA-k9ft-9rnh-h8dn CVE-2026-46366 GHSA-99qv-g4x9-mgc3

Affected version: <=4.1.1

Reported by:
GitHub

[HIGH] phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields

PKSA-n87n-9t5q-zcf5 CVE-2026-46359 GHSA-pm8c-3qq3-72w7

Affected version: <=4.1.1

Reported by:
GitHub

[CRITICAL] phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

PKSA-q6mm-vp1w-mgjs CVE-2026-45010 GHSA-9pq7-mfwh-xx2j

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

PKSA-198b-7kr6-ksdh CVE-2026-46361 GHSA-pqh6-8fxf-jx22

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

PKSA-pmsp-dtdj-k1f9 CVE-2026-45007 GHSA-rm98-82fr-mcfx

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

PKSA-sw8q-jkxw-m11r CVE-2026-46360 GHSA-whqh-9pq5-c7r3

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

PKSA-jr2y-dd2x-qtks CVE-2026-46363 GHSA-f5p7-2c9q-8896

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

PKSA-p58s-jb5m-qycz GHSA-7cx3-2qx2-3g6w

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

PKSA-b77f-s5cd-b1qh CVE-2026-46362 GHSA-hpgw-ww76-c68r

Affected version: <=4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation

PKSA-yy2b-x6vy-wsx2 CVE-2026-34974 GHSA-5crx-pfhq-4hgg

Affected version: <=4.1.0

Reported by:
GitHub

[MEDIUM] phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

PKSA-fk9h-qz7y-fk1q CVE-2026-34973 GHSA-gcp9-5jc8-976x

Affected version: <4.1.1

Reported by:
GitHub

[MEDIUM] phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

PKSA-t2yv-wns1-2p5c CVE-2026-32629 GHSA-98gw-w575-h2ph

Affected version: <=4.1.0

Reported by:
GitHub

[HIGH] phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

PKSA-y9f6-42c9-xggs CVE-2026-27836 GHSA-w22q-m2fm-x9f4

Affected version: <4.0.18

Reported by:
GitHub

[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions

PKSA-2sk9-r8yw-1gc5 CVE-2026-24422 GHSA-j4rc-96xj-gvqc

Affected version: <=4.0.16

Reported by:
GitHub

[MEDIUM] phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

PKSA-fgvt-rx8y-b52y CVE-2026-24421 GHSA-wm8h-26fv-mg7g

Affected version: <=4.0.16

Reported by:
GitHub

[MEDIUM] phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

PKSA-mvwk-xn5v-s54b CVE-2026-24420 GHSA-7p9h-m7m8-vhhv

Affected version: <=4.0.16

Reported by:
GitHub

[HIGH] phpMyFAQ has unauthenticated config backup download via /api/setup/backup

PKSA-w8m6-73n2-zbk6 CVE-2025-69200 GHSA-9cg9-4h4f-j6fg

Affected version: >=4.1.0-alpha,<=4.1.0-beta.2|<4.0.16

Reported by:
GitHub

[MEDIUM] phpMyFAQ contains a CSV injection vulnerability

PKSA-hxrq-cj69-vm9f CVE-2023-53929 GHSA-x2v3-9p22-w3x6

Affected version: <=3.1.12

Reported by:
GitHub

[HIGH] phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

PKSA-zh4p-vq78-zndy CVE-2025-62519 GHSA-fxm2-cmwj-qvx4

Affected version: <=4.0.13

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames

PKSA-nm7m-ddfs-x1rd CVE-2024-55889 GHSA-m3r7-8gw7-qwvc

Affected version: <3.2.10

Reported by:
GitHub

[HIGH] phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

PKSA-zk9c-crx1-g563 CVE-2024-54141 GHSA-vrjr-p3xp-xx2x

Affected version: <4.0.0

Reported by:
GitHub

[MEDIUM] phpMyFAQ Cross-site Scripting vulnerability

PKSA-z2gn-4mp6-7kgx CVE-2023-6889 GHSA-w8xj-992g-842f

Affected version: <3.1.17

Reported by:
GitHub

[MEDIUM] phpMyFAQ Cross-site Scripting vulnerability

PKSA-dp4r-92p1-jm3r CVE-2023-6890 GHSA-4h37-q5j3-hw96

Affected version: <3.1.17

Reported by:
GitHub

[HIGH] phpMyFAQ Cross-site Scripting vulnerability

PKSA-fwqb-wfgt-vhnq CVE-2023-5864 GHSA-g5hp-328h-jj98

Affected version: <3.2.1

Reported by:
GitHub

[HIGH] Insufficient Session Expiration in thorsten/phpmyfaq

PKSA-mhmh-zvw7-ctt3 CVE-2023-5865 GHSA-f728-prhw-2g68

Affected version: <3.2.2

Reported by:
GitHub

[MEDIUM] Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq

PKSA-234x-mfj9-vyxm CVE-2023-5866 GHSA-34w4-wrqp-j47g

Affected version: <3.2.1

Reported by:
GitHub

[MEDIUM] Cross-site Scripting (XSS) in thorsten/phpmyfaq

PKSA-3zxr-6q1g-y9pc CVE-2023-5867 GHSA-prrv-r843-4p75

Affected version: <3.2.2

Reported by:
GitHub

[MEDIUM] phpMyFAQ Cross-site Scripting vulnerability

PKSA-fy6w-gxhz-b2mb CVE-2023-5863 GHSA-j4vj-w5rj-8grw

Affected version: <3.2.2

Reported by:
GitHub

[MEDIUM] phpMyFAQ allows unrestricted file types in image field

PKSA-mb8f-3r9h-zv2d CVE-2023-5227 GHSA-qcjg-hvg6-hxcp

Affected version: <3.1.18

Reported by:
GitHub

[CRITICAL] phpMyFAQ Cross-site Scripting vulnerability

PKSA-j9jt-7g13-t74m CVE-2023-5316 GHSA-58v7-58c2-qwm9

Affected version: <3.1.18

Reported by:
GitHub

[MEDIUM] phpMyFaq Cross-site Scripting vulnerability

PKSA-c9gj-nswj-c8v6 CVE-2023-5317 GHSA-5jwv-m8h3-69cg

Affected version: <3.1.18

Reported by:
GitHub

[HIGH] phpMyFAQ Cross-site Scripting vulnerability

PKSA-473w-z13b-432n CVE-2023-5319 GHSA-j5ww-5xf4-hqm2

Affected version: <3.1.18

Reported by:
GitHub

[CRITICAL] phpMyFAQ Cross-site Scripting vulnerability

PKSA-hr4h-nw1k-8zbd CVE-2023-5320 GHSA-pp4w-g5p4-85p2

Affected version: <3.1.18

Reported by:
GitHub

[HIGH] phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability

PKSA-w38f-g1pw-fptg CVE-2023-4006 GHSA-2xvx-368h-qcmv

Affected version: <3.1.16

Reported by:
GitHub

[HIGH] phpMyFAQ Stored Cross-site Scripting vulnerability

PKSA-x3y4-4qqb-1d8c CVE-2023-4007 GHSA-q9vm-29ph-p7mp

Affected version: <3.1.16

Reported by:
GitHub

[MEDIUM] phpMyFAQ Cross-site Scripting

PKSA-5mf7-1xx2-r8qf CVE-2023-3469 GHSA-v6g2-jwrm-h5r5

Affected version: <3.2.0-beta.2

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to cross-site scripting

PKSA-7skg-fzbb-43pk CVE-2023-2998 GHSA-974q-4vvr-vg9c

Affected version: <3.1.14

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to cross-site scripting

PKSA-449b-pm19-yj3b CVE-2023-2999 GHSA-94r7-63g8-c4jw

Affected version: <3.1.14

Reported by:
GitHub

[MEDIUM] phpMyFAQ vulnerable to stored Cross-site Scripting

PKSA-5wnq-2nqs-gct1 CVE-2023-2752 GHSA-j657-pjgc-c4h6

Affected version: <3.2.0-beta

Reported by:
GitHub

[MEDIUM] phpMyFAQ vulnerable to stored Cross-site Scripting

PKSA-nbfj-yt53-w4ff CVE-2023-2753 GHSA-vppq-6ff8-2m8w

Affected version: <3.2.0-beta

Reported by:
GitHub

[MEDIUM] Cross Site Scripting in thorsten/phpmyfaq

PKSA-8ptm-w337-39j1 CVE-2023-2427 GHSA-5xq3-7mw9-wj5p

Affected version: <3.1.13

Reported by:
GitHub

[HIGH] Cross Site Scripting in thorsten/phpmyfaq

PKSA-q9pv-n8rg-hsyq CVE-2023-2550 GHSA-5mf7-p346-7rm8

Affected version: <3.1.13

Reported by:
GitHub

[MEDIUM] phpMyFAQ Improper Access Control vulnerability

PKSA-mtm1-ss8g-wgvd CVE-2023-2429 GHSA-r69v-q48g-3966

Affected version: <3.1.13

Reported by:
GitHub

[MEDIUM] phpMyFAQ vulnerable to Stored Cross-site Scripting

PKSA-d9fp-49zx-fym9 CVE-2023-2428 GHSA-8595-6653-96p2

Affected version: <3.1.13

Reported by:
GitHub

[MEDIUM] Cross-site Scripting in thorsten/phpmyfaq

PKSA-71zg-c8q3-sbmg CVE-2023-1875 GHSA-ch5w-2994-6h82

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export

PKSA-6qy9-qd3n-yn3h CVE-2023-1756 GHSA-8p48-ghv5-7qq7

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter

PKSA-d5r8-gd2b-r4rc CVE-2023-1757 GHSA-jvjx-qqh7-6x6c

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter

PKSA-5jvn-xj5h-yxw7 CVE-2023-1758 GHSA-3j93-7rf7-p7m6

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog

PKSA-45xh-5fph-j6xf CVE-2023-1878 GHSA-gcmq-7652-x98j

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter

PKSA-mj8w-pf9f-4g8q CVE-2023-1879 GHSA-m9qm-m5w5-9pgj

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter

PKSA-gbwf-9cxb-136d CVE-2023-1880 GHSA-m8q9-7v2f-qjx9

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter

PKSA-swvz-9q1j-53jy CVE-2023-1882 GHSA-jph3-3j24-pg3j

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to improper access control

PKSA-dxhp-3xs3-tcm8 CVE-2023-1883 GHSA-2wjp-w7g7-h63q

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter

PKSA-bqhx-wnn4-htts CVE-2023-1884 GHSA-gmjj-g2rm-xwm7

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter

PKSA-rw83-nw8n-wh2r CVE-2023-1885 GHSA-xxm6-ff3x-v4vm

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to authentication bypass

PKSA-3sdr-k7b7-rx6w CVE-2023-1886 GHSA-4cr4-x82x-hwm9

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable to business logic errors

PKSA-w163-ccsb-gq3p CVE-2023-1887 GHSA-gx43-fqrx-6fcw

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ has weak password requirements

PKSA-55zv-d6h5-byt9 CVE-2023-1753 GHSA-4p4m-5qp7-479x

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ vulnerable to improper input validation

PKSA-cw8t-wqhf-zqgj CVE-2023-1754 GHSA-gvg8-r8w2-9gfj

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ Cross-site Scripting vulnerability

PKSA-kvnf-yxzf-9g2b CVE-2023-1755 GHSA-hp8m-g55r-9cfq

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ Stored Cross-site Scripting vulnerability

PKSA-wcp5-zdy4-3g35 CVE-2023-1759 GHSA-4wfc-ghv5-2v7j

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ Stored Cross-site Scripting vulnerability

PKSA-p4d8-zbxb-db5j CVE-2023-1760 GHSA-7q9c-f2v8-j8gw

Affected version: <3.1.12

Reported by:
GitHub

[MEDIUM] phpMyFAQ Code Injection vulnerability

PKSA-ygh6-5ch1-kqxt CVE-2023-1761 GHSA-6cpg-gqgq-2rrr

Affected version: <3.1.12

Reported by:
GitHub

[HIGH] thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management

PKSA-r4fn-pcgz-rj1v CVE-2023-1762 GHSA-xww4-w6ff-5q3g

Affected version: <3.1.12

Reported by:
GitHub