thorsten
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 58
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, thorsten recorded 58 security vulnerabilities in the last 90 days across 1 products, including 32 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, phpMyFAQ had the most security vulnerabilities in the thorsten ecosystem, with 58 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupControllerCVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDCVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image FetchingCVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential InjectionCVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController | Exploitation statusNot confirmed | FixYes |
| Affected productphpMyFAQ |
| Published11/08/2026 |
| SeverityHigh |
CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published10/25/2026 | SeverityHigh |
|---|
CVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityCritical |
|---|
CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111909phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111908phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111907phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111906phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111905phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111903phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111902phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111900phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111898phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111897phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111896phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111895phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111894phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111893phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111890phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111889phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111887phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111886phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111885phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks | Exploitation statusNot confirmed | FixYes | Affected productphpMyFAQ | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-109573phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/12/2026 | SeverityCritical |
|---|
CVE-2026-108851phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/11/2026 | SeverityMedium |
|---|
CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | Exploitation statusNot exploited | FixNo | Affected productphpMyFAQ | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factor | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published09/24/2026 | SeverityMedium |
|---|
CVE-2026-85593phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85592phpMyFAQ before 4.1.8 Authorization Bypass via question/create | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85591phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-85590phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-85589phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85588phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85587phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85586phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-76215phpMyFAQ before 4.1.7 Missing Authorization via child resources | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76214phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-76213phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-76212phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76211phpMyFAQ before 4.1.7 Information Disclosure via Admin API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
176 Results | Page 1 of 4