Security Advisories - phpmyfaq/phpmyfaq

phpmyfaq/phpmyfaq Security Advisories for 2.8.0-RC (33)

[HIGH] phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

PKSA-5kfv-yxk9-ft5p CVE-2026-56738 GHSA-rw77-vq4g-x3hp

Affected version: <=4.1.5

Reported by:
GitHub
[HIGH] phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

PKSA-rrfb-2zp9-ws1j CVE-2026-56736 GHSA-pgwp-vc7q-cvj3

Affected version: <4.2.0-alpha

Reported by:
GitHub
[HIGH] phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

PKSA-p7rj-kmfh-92s9 GHSA-pg62-f8g4-4wqh

Affected version: <=4.1.4

Reported by:
GitHub
[HIGH] phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

PKSA-nnfw-464q-679b GHSA-985r-q3qp-299h

Affected version: <=4.1.3

Reported by:
GitHub
[MEDIUM] phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

PKSA-ncdr-61sw-52cy CVE-2026-49205 GHSA-8c6h-7g6x-m5x4

Affected version: <4.1.4

Reported by:
GitHub
[LOW] phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

PKSA-rr72-yd9q-kc5n CVE-2026-48488 GHSA-58fg-62fg-3fcj

Affected version: <=4.1.3

Reported by:
GitHub
[HIGH] phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

PKSA-527c-n963-c1j5 CVE-2026-35675 GHSA-w9xh-5f39-vq89

Affected version: <4.1.3

Reported by:
GitHub
[HIGH] phpMyFAQ: Default Empty API Token Authentication Bypass

PKSA-xr26-9czp-vbgk CVE-2026-35672 GHSA-gp95-j463-vv28

Affected version: <=4.1.2

Reported by:
GitHub
[HIGH] phpMyFAQ: IDOR Account Takeover

PKSA-vdjw-v652-d3d9 CVE-2026-35671 GHSA-xvp4-phqj-cjr3

Affected version: <4.1.3

Reported by:
GitHub
[HIGH] phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

PKSA-1ckg-7bmf-xkmp CVE-2026-35676 GHSA-9qv9-8xv6-5p35

Affected version: <4.1.3

Reported by:
GitHub
[CRITICAL] phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

PKSA-6nrc-qfr1-rds3 CVE-2026-46364 GHSA-289f-fq7w-6q2w

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

PKSA-tvkw-wcnm-h63h CVE-2026-45008 GHSA-gh9p-q46p-57g2

Affected version: <=4.1.1

Reported by:
GitHub
[HIGH] phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

PKSA-76kk-7mdh-r8h5 CVE-2026-46366 GHSA-99qv-g4x9-mgc3

Affected version: <=4.1.1

Reported by:
GitHub
[HIGH] phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields

PKSA-r4gq-dd3d-gxrj CVE-2026-46359 GHSA-pm8c-3qq3-72w7

Affected version: <=4.1.1

Reported by:
GitHub
[CRITICAL] phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

PKSA-6pt5-mfr3-5b72 CVE-2026-45010 GHSA-9pq7-mfwh-xx2j

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

PKSA-7dk8-b5d5-n9bf CVE-2026-46361 GHSA-pqh6-8fxf-jx22

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

PKSA-n88j-cgtd-2fvg CVE-2026-45007 GHSA-rm98-82fr-mcfx

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

PKSA-jn65-sph2-9wn9 CVE-2026-46360 GHSA-whqh-9pq5-c7r3

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

PKSA-6zc3-3brt-ftsh CVE-2026-46363 GHSA-f5p7-2c9q-8896

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

PKSA-117q-9kx2-kjzm GHSA-7cx3-2qx2-3g6w

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

PKSA-8syh-w2cp-tqks CVE-2026-46362 GHSA-hpgw-ww76-c68r

Affected version: <=4.1.1

Reported by:
GitHub
[MEDIUM] phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

PKSA-yq8b-v8fg-rvf8 CVE-2026-34729 GHSA-cv2g-8cj8-vgc7

Affected version: <=4.1.0

Reported by:
GitHub
[HIGH] phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

PKSA-n57d-sn2t-c46g CVE-2026-34728 GHSA-38m8-xrfj-v38x

Affected version: <=4.1.0

Reported by:
GitHub
[MEDIUM] phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

PKSA-25jh-4r4k-gpj5 CVE-2026-32629 GHSA-98gw-w575-h2ph

Affected version: <=4.1.0

Reported by:
GitHub
[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions

PKSA-g4rh-637x-8kby CVE-2026-24422 GHSA-j4rc-96xj-gvqc

Affected version: <=4.0.16

Reported by:
GitHub
[MEDIUM] phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

PKSA-kw83-ss3b-tqsv CVE-2026-24421 GHSA-wm8h-26fv-mg7g

Affected version: <=4.0.16

Reported by:
GitHub
[MEDIUM] phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

PKSA-bn6v-4n7v-4dtq CVE-2026-24420 GHSA-7p9h-m7m8-vhhv

Affected version: <=4.0.16

Reported by:
GitHub
[MEDIUM] phpMyFAQ contains a CSV injection vulnerability

PKSA-1cq7-dh6p-78w8 CVE-2023-53929 GHSA-x2v3-9p22-w3x6

Affected version: <=3.1.12

Reported by:
GitHub
[HIGH] phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

PKSA-mvvf-b3jn-bt43 CVE-2025-62519 GHSA-fxm2-cmwj-qvx4

Affected version: <=4.0.13

Reported by:
GitHub
[MEDIUM] phpMyFAQ vulnerable to stored XSS on attachments filename

PKSA-hdfq-3r6d-xzjt CVE-2024-24574 GHSA-7m8g-fprr-47fx

Affected version: <3.2.5

Reported by:
GitHub
[MEDIUM] phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes

PKSA-qfjp-pm9r-s97r CVE-2024-22208 GHSA-9hhf-xmcw-r3xg

Affected version: <3.2.5

Reported by:
GitHub
[MEDIUM] phpMyFAQ User Removal Page Allows Spoofing Of User Details

PKSA-q87w-7ynx-prc4 CVE-2024-22202 GHSA-6648-6g96-mg35

Affected version: <3.2.5

Reported by:
GitHub
[HIGH] phpMyFAQ vulnerable to Cross-site Scripting

PKSA-k57y-tc6t-fmbw CVE-2022-3608 GHSA-6rj8-9cm9-6gff

Affected version: <=3.1.7

Reported by:
GitHub

phpmyfaq/phpmyfaq Security Advisories for 2.8.0-RC (33)

[HIGH] phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

[HIGH] phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

[HIGH] phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

[HIGH] phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

[MEDIUM] phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

[LOW] phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

[HIGH] phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration

[HIGH] phpMyFAQ: Default Empty API Token Authentication Bypass

[HIGH] phpMyFAQ: IDOR Account Takeover

[HIGH] phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

[CRITICAL] phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

[MEDIUM] phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

[HIGH] phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

[HIGH] phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields

[CRITICAL] phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

[MEDIUM] phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

[MEDIUM] phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

[MEDIUM] phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

[MEDIUM] phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

[MEDIUM] phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

[MEDIUM] phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

[MEDIUM] phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

[HIGH] phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

[MEDIUM] phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions

[MEDIUM] phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)

[MEDIUM] phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

[MEDIUM] phpMyFAQ contains a CSV injection vulnerability

[HIGH] phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

[MEDIUM] phpMyFAQ vulnerable to stored XSS on attachments filename

[MEDIUM] phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes

[MEDIUM] phpMyFAQ User Removal Page Allows Spoofing Of User Details

[HIGH] phpMyFAQ vulnerable to Cross-site Scripting