- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, phpMyFAQ recorded 59 security vulnerabilities in the last 90 days, of which 33 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of phpMyFAQ and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-76210phpMyFAQ before v4.1.6 Local File Disclosure via PDF ExportCVE-2026-76209phpMyFAQ before v4.1.6 Registration Bypass via APICVE-2026-76208phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPCVE-2026-76207phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me CookieCVE-2026-76206phpMyFAQ before 4.1.7 Information Disclosure via PDF Export| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-76210phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-76209phpMyFAQ before v4.1.6 Registration Bypass via API | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76208phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-76207phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-76206phpMyFAQ before 4.1.7 Information Disclosure via PDF Export | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76205phpMyFAQ before 4.1.7 SQL Injection via Glossary | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-75920phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-75919phpMyFAQ before 4.1.7 Authentication Bypass via Setup API | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-75918phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-66399phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-66398phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityCritical |
|---|
CVE-2026-66397phpMyFAQ before 4.1.6 Path Traversal via category image deletion | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-49205phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | Exploitation statusNot exploited | FixYes | Published06/18/2026 | SeverityMedium |
|---|
CVE-2026-48488phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing | Exploitation statusNot exploited | FixNo | Published06/08/2026 | SeverityLow |
|---|
CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint | Exploitation statusActively exploited | FixYes | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update | Exploitation statusActively exploited | FixYes | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API Token | Exploitation statusActively exploited | FixYes | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password API | Exploitation statusActively exploited | FixYes | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-46367phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46366phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46365phpMyFAQ - Missing Authorization in Tag Deletion Endpoint | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46364phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha | Exploitation statusNot exploited | FixYes | Published05/15/2026 | SeverityCritical |
|---|
CVE-2026-46363phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46362phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46361phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46360phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46359phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-45010phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityCritical |
|---|
CVE-2026-45009phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-45008phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-45007phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure | Exploitation statusActively exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-34974phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34973phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34729phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34728phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityHigh |
|---|
CVE-2026-32629phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor | Exploitation statusActively exploited | FixYes | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-27836phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | Exploitation statusActively exploited | FixNo | Published02/27/2026 | SeverityHigh |
|---|
CVE-2026-24422phpMyFAQ: Public API endpoints expose emails and invisible questions | Exploitation statusActively exploited | FixYes | Published01/24/2026 | SeverityMedium |
|---|
CVE-2026-24421phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user | Exploitation statusNot exploited | FixYes | Published01/24/2026 | SeverityMedium |
|---|
CVE-2026-24420phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) | Exploitation statusActively exploited | FixYes | Published01/24/2026 | SeverityMedium |
|---|
CVE-2025-69200phpMyFAQ has unauthenticated config backup download via /api/setup/backup | Exploitation statusActively exploited | FixNo | Published12/29/2025 | SeverityHigh |
|---|
CVE-2025-68951phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw | Exploitation statusActively exploited | FixNo | Published12/29/2025 | SeverityMedium |
|---|
CVE-2025-62519phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | Exploitation statusActively exploited | FixYes | Published11/17/2025 | SeverityHigh |
|---|
CVE-2025-59943phpMyFAQ duplicate email registration allows multiple accounts with the same email | Exploitation statusActively exploited | FixYes | Published10/03/2025 | SeverityHigh |
|---|
CVE-2024-56199phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | Exploitation statusActively exploited | FixNo | Published01/02/2025 | SeverityMedium |
|---|
CVE-2024-55889phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames | Exploitation statusActively exploited | FixNo | Published12/13/2024 | SeverityMedium |
|---|
CVE-2024-54141phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | Exploitation statusActively exploited | FixYes | Published12/06/2024 | SeverityHigh |
|---|
CVE-2024-29196phpMyFAQ Path Traversal in Attachments | Exploitation statusActively exploited | FixYes | Published03/26/2024 | SeverityLow |
|---|
CVE-2024-29179phpMyFAQ Stored Cross-site Scripting at File Attachments | Exploitation statusNot exploited | FixNo | Published03/25/2024 | SeverityMedium |
|---|
CVE-2024-28108phpMyFAQ Stored HTML Injection at contentLink | Exploitation statusActively exploited | FixYes | Published03/25/2024 | SeverityMedium |
|---|
108 Results | Page 2 of 3