thorsten
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 58
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, thorsten recorded 58 security vulnerabilities in the last 90 days across 1 products, including 32 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, phpMyFAQ had the most security vulnerabilities in the thorsten ecosystem, with 58 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-76210phpMyFAQ before v4.1.6 Local File Disclosure via PDF ExportCVE-2026-76209phpMyFAQ before v4.1.6 Registration Bypass via APICVE-2026-76208phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAPCVE-2026-76207phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me CookieCVE-2026-76206phpMyFAQ before 4.1.7 Information Disclosure via PDF Export| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-76210phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | Exploitation statusActively exploited | FixYes |
| Published08/19/2026 |
| SeverityHigh |
CVE-2026-76209phpMyFAQ before v4.1.6 Registration Bypass via API | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76208phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-76207phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-76206phpMyFAQ before 4.1.7 Information Disclosure via PDF Export | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-76205phpMyFAQ before 4.1.7 SQL Injection via Glossary | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-75920phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-75919phpMyFAQ before 4.1.7 Authentication Bypass via Setup API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-75918phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-66399phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-66398phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published07/27/2026 | SeverityCritical |
|---|
CVE-2026-66397phpMyFAQ before 4.1.6 Path Traversal via category image deletion | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-49205phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published06/18/2026 | SeverityMedium |
|---|
CVE-2026-48488phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing | Exploitation statusNot exploited | FixNo | Affected productphpMyFAQ | Published06/08/2026 | SeverityLow |
|---|
CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API Token | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password API | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/28/2026 | SeverityHigh |
|---|
CVE-2026-46367phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46366phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46365phpMyFAQ - Missing Authorization in Tag Deletion Endpoint | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46364phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityCritical |
|---|
CVE-2026-46363phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46362phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46361phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-46360phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-46359phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-45010phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityCritical |
|---|
CVE-2026-45009phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-45008phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityHigh |
|---|
CVE-2026-45007phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-34974phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34973phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34729phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-34728phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published04/02/2026 | SeverityHigh |
|---|
CVE-2026-32629phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-27836phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published02/27/2026 | SeverityHigh |
|---|
CVE-2026-24422phpMyFAQ: Public API endpoints expose emails and invisible questions | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published01/24/2026 | SeverityMedium |
|---|
CVE-2026-24421phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user | Exploitation statusNot exploited | FixYes | Affected productphpMyFAQ | Published01/24/2026 | SeverityMedium |
|---|
CVE-2026-24420phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published01/24/2026 | SeverityMedium |
|---|
CVE-2025-69200phpMyFAQ has unauthenticated config backup download via /api/setup/backup | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published12/29/2025 | SeverityHigh |
|---|
CVE-2025-68951phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published12/29/2025 | SeverityMedium |
|---|
CVE-2025-62519phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published11/17/2025 | SeverityHigh |
|---|
CVE-2025-59943phpMyFAQ duplicate email registration allows multiple accounts with the same email | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published10/03/2025 | SeverityHigh |
|---|
CVE-2024-56199phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published01/02/2025 | SeverityMedium |
|---|
CVE-2024-55889phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames | Exploitation statusActively exploited | FixNo | Affected productphpMyFAQ | Published12/13/2024 | SeverityMedium |
|---|
CVE-2024-54141phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published12/06/2024 | SeverityHigh |
|---|
CVE-2024-29196phpMyFAQ Path Traversal in Attachments | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published03/26/2024 | SeverityLow |
|---|
CVE-2024-29179phpMyFAQ Stored Cross-site Scripting at File Attachments | Exploitation statusNot exploited | FixNo | Affected productphpMyFAQ | Published03/25/2024 | SeverityMedium |
|---|
CVE-2024-28108phpMyFAQ Stored HTML Injection at contentLink | Exploitation statusActively exploited | FixYes | Affected productphpMyFAQ | Published03/25/2024 | SeverityMedium |
|---|
176 Results | Page 2 of 4