60087 matches found
CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...
CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...
EUVD-2026-62448
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
EUVD-2026-62444
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
CVE-2026-75919
phpMyFAQ before 4.1.7 has an authentication bypass in SetupController. Unauthenticated attackers can call POST /api/setup/update-database and POST /api/setup/backup while maintenance mode is enabled to run database migrations, disable maintenance mode, and extract database credentials from genera...
CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CGA-F8FR-G9GW-GWRH
Bulletin has no description...
MINI-FQXW-MRRQ-3Q23
Bulletin has no description...
MINI-GPC7-W773-VHG4
Bulletin has no description...
MINI-R86X-8JJM-CPHQ
Bulletin has no description...
MINI-Q6FP-FG97-4J43
Bulletin has no description...
MINI-6R63-R9H7-9X5M
Bulletin has no description...
MINI-5PF8-JGMR-3RWH
Bulletin has no description...