- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, phpMyFAQ recorded 59 security vulnerabilities in the last 90 days, of which 33 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of phpMyFAQ and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupControllerCVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDCVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image FetchingCVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential InjectionCVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController | Exploitation statusNot confirmed | FixYes |
| SeverityHigh |
CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID | Exploitation statusNot exploited | FixYes | Published10/25/2026 | SeverityHigh |
|---|
CVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching | Exploitation statusActively exploited | FixYes | Published10/25/2026 | SeverityMedium |
|---|
CVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityCritical |
|---|
CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111909phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API | Exploitation statusNot exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111908phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111907phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database | Exploitation statusNot exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111906phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111905phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111903phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass | Exploitation statusActively exploited | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111902phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API | Exploitation statusNot exploited | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111900phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111898phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111897phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111896phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111895phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111894phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111893phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111890phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111889phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111887phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-111886phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111885phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks | Exploitation statusNot confirmed | FixYes | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-109573phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityCritical |
|---|
CVE-2026-108851phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool | Exploitation statusActively exploited | FixYes | Published10/11/2026 | SeverityMedium |
|---|
CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | Exploitation statusNot exploited | FixNo | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factor | Exploitation statusActively exploited | FixYes | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | Exploitation statusActively exploited | FixNo | Published09/24/2026 | SeverityHigh |
|---|
CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | Exploitation statusActively exploited | FixNo | Published09/24/2026 | SeverityMedium |
|---|
CVE-2026-85593phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | Exploitation statusNot exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85592phpMyFAQ before 4.1.8 Authorization Bypass via question/create | Exploitation statusActively exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85591phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change | Exploitation statusNot exploited | FixYes | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-85590phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable | Exploitation statusActively exploited | FixYes | Published09/04/2026 | SeverityHigh |
|---|
CVE-2026-85589phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API | Exploitation statusActively exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85588phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export | Exploitation statusNot exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85587phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages | Exploitation statusActively exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-85586phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter | Exploitation statusNot exploited | FixYes | Published09/04/2026 | SeverityMedium |
|---|
CVE-2026-76215phpMyFAQ before 4.1.7 Missing Authorization via child resources | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76214phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-76213phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-76212phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76211phpMyFAQ before 4.1.7 Information Disclosure via Admin API | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
108 Results | Page 1 of 3