Phpmyfaq v3.1.11 - Cross-Site Scripting

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized. id: CVE-2023-1880 info: name: Phpmyfaq v3.1.11 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend...

phpMyFAQ < 3.2.0 - Cross-site Scripting

Cross-site Scripting XSS Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. id: CVE-2023-5863 info: name: phpMyFAQ ' - 'phpMyFAQ' condition: and - type: word part: header words: - "text...

phpMyFAQ < 3.1.8 - Cross-Site Scripting

phpMyFAQ versions prior to 3.1.8 contain a reflected cross-site scripting vulnerability in the search functionality. The application fails to properly sanitize user input in the search parameter, allowing attackers to inject and execute malicious JavaScript code in the context of other users'...

phpMyFAQ <= 4.1.1 - SQL Injection

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...

phpMyFAQ - Configuration Backup Disclosure

phpMyFAQ = 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication. id: CVE-2025-69200 info: name: phpMyFAQ -...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

GHSA-RW77-VQ4G-X3HP phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

Improper Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

Improper Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

GHSA-8GPW-XVPF-HVX5 phpMyFAQ's two-factor authentication login bypasses the password factor

Summary The public two-factor verification endpoint POST /check logs a user in based solely on a valid 6-digit TOTP token and a chosen user-id. It does not require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker...

phpMyFAQ's two-factor authentication login bypasses the password factor

Summary The public two-factor verification endpoint POST /check logs a user in based solely on a valid 6-digit TOTP token and a chosen user-id. It does not require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker...

GHSA-PGWP-VC7Q-CVJ3 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

CVE-2026-47132

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-56738

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...

EUVD-2026-86290

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-47132 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-47132

The open source FAQ web application phpMyFAQ (prior to version 4.2.0-alpha ) is vulnerable to an SQL LIKE wildcard injection in its chat user search endpoint. The application fails to escape the % and _ characters in the q parameter of the GET /api/chat/users?q=... endpoint. While the system uses...