Phpmyfaq
by PhpMyAdmin
Source repositories
CVEs (170)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-15734 | Hig | 0.53 | 8.8 | 0.01 | Oct 22, 2017 | In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. | ||
| CVE-2026-45010 | Cri | 0.52 | 9.1 | 0.00 | May 15, 2026 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's… | ||
| CVE-2026-35671 | Hig | 0.50 | 8.8 | 0.00 | May 28, 2026 | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials… | ||
| CVE-2026-34728 | Hig | 0.50 | 8.7 | 0.01 | Apr 2, 2026 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload… | ||
| CVE-2024-28107 | Hig | 0.50 | 8.8 | 0.01 | Mar 25, 2024 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any… | ||
| CVE-2024-27299 | Hig | 0.50 | 8.8 | 0.01 | Mar 25, 2024 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the… | ||
| CVE-2023-1762 | Hig | 0.50 | 8.8 | 0.01 | Mar 31, 2023 | Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2024-54141 | Hig | 0.49 | 8.6 | 0.00 | Dec 6, 2024 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0. | ||
| CVE-2023-0786 | Hig | 0.48 | 8.4 | 0.01 | Feb 12, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2022-3608 | Hig | 0.48 | 8.4 | 0.01 | Oct 19, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha. | ||
| CVE-2025-62519 | Hig | 0.47 | 7.2 | 0.01 | Nov 17, 2025 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands.… | ||
| CVE-2023-0880 | Hig | 0.47 | 8.3 | 0.01 | Feb 17, 2023 | Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2023-0794 | Hig | 0.47 | 8.3 | 0.01 | Feb 12, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2023-0791 | Hig | 0.47 | 8.3 | 0.01 | Feb 12, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2018-16651 | Hig | 0.47 | 7.2 | 0.01 | Sep 7, 2018 | The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports. | ||
| CVE-2026-35676 | Hig | 0.46 | 8.2 | 0.00 | May 28, 2026 | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password… | ||
| CVE-2026-35675 | Hig | 0.46 | 8.2 | 0.00 | May 28, 2026 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain… | ||
| CVE-2025-59943 | Hig | 0.46 | 8.1 | 0.00 | Oct 3, 2025 | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier… | ||
| CVE-2023-0789 | Hig | 0.46 | 8.1 | 0.02 | Feb 12, 2023 | Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2023-0788 | Hig | 0.46 | 8.1 | 0.01 | Feb 12, 2023 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
- risk 0.53cvss 8.8epss 0.01
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
- risk 0.52cvss 9.1epss 0.00
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's…
- risk 0.50cvss 8.8epss 0.00
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials…
- risk 0.50cvss 8.7epss 0.01
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload…
- risk 0.50cvss 8.8epss 0.01
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any…
- risk 0.50cvss 8.8epss 0.01
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the…
- risk 0.50cvss 8.8epss 0.01
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.49cvss 8.6epss 0.00
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.
- risk 0.48cvss 8.4epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.48cvss 8.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
- risk 0.47cvss 7.2epss 0.01
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands.…
- risk 0.47cvss 8.3epss 0.01
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.47cvss 8.3epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.47cvss 8.3epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.47cvss 7.2epss 0.01
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.
- risk 0.46cvss 8.2epss 0.00
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password…
- risk 0.46cvss 8.2epss 0.00
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain…
- risk 0.46cvss 8.1epss 0.00
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier…
- risk 0.46cvss 8.1epss 0.02
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.46cvss 8.1epss 0.01
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Page 2 of 9