[HIGH] phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

PKSA-mq9q-wz1h-jkfd CVE-2026-56738 GHSA-rw77-vq4g-x3hp

Affected version: <=4.1.5

Reported by:
GitHub

[HIGH] phpMyFAQ's two-factor authentication login bypasses the password factor

PKSA-p9tj-4psw-jkcc CVE-2026-56737 GHSA-8gpw-xvpf-hvx5

Affected version: >=3.2.0,<4.1.6

Reported by:
GitHub

[HIGH] phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

PKSA-xsdh-jbbj-vv28 CVE-2026-56736 GHSA-pgwp-vc7q-cvj3

Affected version: <4.2.0-alpha

Reported by:
GitHub

[MEDIUM] phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

PKSA-cz4f-38kk-4ywj CVE-2026-47132 GHSA-6pvm-2vjj-rx4w

Affected version: <4.2.0-alpha

Reported by:
GitHub