thorsten/phpmyfaq Security Advisories for 3.2.0-beta (17)
-
[MEDIUM] phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
PKSA-yy2b-x6vy-wsx2 CVE-2026-34974 GHSA-5crx-pfhq-4hgg
Affected version: <=4.1.0
Reported by:
GitHub -
[MEDIUM] phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
PKSA-fk9h-qz7y-fk1q CVE-2026-34973 GHSA-gcp9-5jc8-976x
Affected version: <4.1.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
PKSA-t2yv-wns1-2p5c CVE-2026-32629 GHSA-98gw-w575-h2ph
Affected version: <=4.1.0
Reported by:
GitHub -
[HIGH] phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
PKSA-y9f6-42c9-xggs CVE-2026-27836 GHSA-w22q-m2fm-x9f4
Affected version: <4.0.18
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions
PKSA-2sk9-r8yw-1gc5 CVE-2026-24422 GHSA-j4rc-96xj-gvqc
Affected version: <=4.0.16
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
PKSA-fgvt-rx8y-b52y CVE-2026-24421 GHSA-wm8h-26fv-mg7g
Affected version: <=4.0.16
Reported by:
GitHub -
[MEDIUM] phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
PKSA-mvwk-xn5v-s54b CVE-2026-24420 GHSA-7p9h-m7m8-vhhv
Affected version: <=4.0.16
Reported by:
GitHub -
[HIGH] phpMyFAQ has unauthenticated config backup download via /api/setup/backup
PKSA-w8m6-73n2-zbk6 CVE-2025-69200 GHSA-9cg9-4h4f-j6fg
Affected version: >=4.1.0-alpha,<=4.1.0-beta.2|<4.0.16
Reported by:
GitHub -
[HIGH] phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
PKSA-zh4p-vq78-zndy CVE-2025-62519 GHSA-fxm2-cmwj-qvx4
Affected version: <=4.0.13
Reported by:
GitHub -
[MEDIUM] thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames
PKSA-nm7m-ddfs-x1rd CVE-2024-55889 GHSA-m3r7-8gw7-qwvc
Affected version: <3.2.10
Reported by:
GitHub -
[HIGH] phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available
PKSA-zk9c-crx1-g563 CVE-2024-54141 GHSA-vrjr-p3xp-xx2x
Affected version: <4.0.0
Reported by:
GitHub -
[MEDIUM] Cross-site Scripting (XSS) in thorsten/phpmyfaq
PKSA-3zxr-6q1g-y9pc CVE-2023-5867 GHSA-prrv-r843-4p75
Affected version: <3.2.2
Reported by:
GitHub -
[MEDIUM] Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq
PKSA-234x-mfj9-vyxm CVE-2023-5866 GHSA-34w4-wrqp-j47g
Affected version: <3.2.1
Reported by:
GitHub -
[HIGH] Insufficient Session Expiration in thorsten/phpmyfaq
PKSA-mhmh-zvw7-ctt3 CVE-2023-5865 GHSA-f728-prhw-2g68
Affected version: <3.2.2
Reported by:
GitHub -
[HIGH] phpMyFAQ Cross-site Scripting vulnerability
PKSA-fwqb-wfgt-vhnq CVE-2023-5864 GHSA-g5hp-328h-jj98
Affected version: <3.2.1
Reported by:
GitHub -
[MEDIUM] phpMyFAQ Cross-site Scripting vulnerability
PKSA-fy6w-gxhz-b2mb CVE-2023-5863 GHSA-j4vj-w5rj-8grw
Affected version: <3.2.2
Reported by:
GitHub -
[MEDIUM] phpMyFAQ Cross-site Scripting
PKSA-5mf7-1xx2-r8qf CVE-2023-3469 GHSA-v6g2-jwrm-h5r5
Affected version: <3.2.0-beta.2
Reported by:
GitHub