thorsten/phpmyfaq
Open source FAQ web application for PHP 8.4+ with multi-database support, full-text search, user management, and a REST API
Security Advisories for thorsten/phpmyfaq in packagist
High
7 days ago
phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
7 days ago
phpMyFAQ public FAQ APIs expose inactive FAQ content
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
7 days ago
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
20 days ago
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
packagist
thorsten/phpmyfaq
High
2 months ago
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
2 months ago
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Low
2 months ago
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
3 months ago
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
3 months ago
phpMyFAQ: Default Empty API Token Authentication Bypass
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
3 months ago
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Critical
4 months ago
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
4 months ago
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
4 months ago
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
4 months ago
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Critical
4 months ago
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
4 months ago
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
4 months ago
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
4 months ago
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
4 months ago
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
4 months ago
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
4 months ago
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
4 months ago
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
High
4 months ago
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Moderate
5 months ago
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
packagist
thorsten/phpmyfaq
Moderate
5 months ago
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
packagist
thorsten/phpmyfaq
Moderate
5 months ago
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
6 months ago
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
packagist
thorsten/phpmyfaq
Moderate
7 months ago
phpMyFAQ: Public API endpoints expose emails and invisible questions
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
7 months ago
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
7 months ago
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
High
8 months ago
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
packagist
thorsten/phpmyfaq
Moderate
8 months ago
phpMyFAQ has Stored XSS in user list via admin-managed display_name
packagist
thorsten/phpmyfaq
High
10 months ago
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
packagist
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
High
11 months ago
phpMyFAQ duplicate email registration allows multiple accounts with the same email
packagist
thorsten/phpmyfaq
Moderate
over 1 year ago
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
packagist
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Moderate
over 1 year ago
thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames
packagist
thorsten/phpmyfaq
High
over 1 year ago
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available
packagist
thorsten/phpmyfaq
Likely fork
Moderate
over 2 years ago
phpMyFAQ stored Cross-site Scripting at user email
packagist
phpmyfaq/phpmyfaq
Likely fork
High
over 2 years ago
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
packagist
phpmyfaq/phpmyfaq
Likely fork
Moderate
over 2 years ago
phpMyFAQ Stored Cross-site Scripting at FAQ News Content
packagist
phpmyfaq/phpmyfaq
Likely fork
High
over 2 years ago
phpMyFAQ SQL injections at insertentry & saveentry
packagist
phpmyfaq/phpmyfaq
Likely fork
Likely fork
Moderate
over 2 years ago
phpMyFAQ Stored Cross-site Scripting at File Attachments
packagist
phpmyfaq/phpmyfaq
Likely fork
Likely fork
Likely fork
Moderate
over 2 years ago
phpMyFAQ vulnerable to stored XSS on attachments filename
packagist
phpmyfaq/phpmyfaq
Likely fork
Moderate
over 2 years ago
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
packagist
phpmyfaq/phpmyfaq
Likely fork
Moderate
over 2 years ago
phpMyFAQ User Removal Page Allows Spoofing Of User Details
packagist
phpmyfaq/phpmyfaq
Moderate
almost 3 years ago
Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq
packagist
thorsten/phpmyfaq
High
almost 3 years ago
Insufficient Session Expiration in thorsten/phpmyfaq
packagist
thorsten/phpmyfaq
Moderate
almost 3 years ago
Cross-site Scripting (XSS) in thorsten/phpmyfaq
packagist
thorsten/phpmyfaq
Moderate
almost 3 years ago
phpMyFAQ allows unrestricted file types in image field
packagist
thorsten/phpmyfaq
High
about 3 years ago
phpMyFAQ Stored Cross-site Scripting vulnerability
packagist
thorsten/phpmyfaq
High
about 3 years ago
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to cross-site scripting
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to cross-site scripting
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ vulnerable to stored Cross-site Scripting
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ vulnerable to stored Cross-site Scripting
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ Improper Access Control vulnerability
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ vulnerable to Stored Cross-site Scripting
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to authentication bypass
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to business logic errors
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
thorsten/phpmyfaq vulnerable to improper access control
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ Stored Cross-site Scripting vulnerability
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ vulnerable to improper input validation
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
phpMyFAQ Stored Cross-site Scripting vulnerability
packagist
thorsten/phpmyfaq
High
over 3 years ago
thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management
packagist
thorsten/phpmyfaq
Moderate
over 3 years ago
Misinterpretation of Input in thorsten/phpmyfaq
packagist
thorsten/phpmyfaq