CVE-2026-108851

The phpMyFAQ application (through version 4.1.10 ) is vulnerable to a missing authorization flaw in the MCP server faq_search tool . The root cause is that the Search::searchDatabase() function fails to apply necessary user or group permission checks. Consequently, an attacker connected to the ph...

CVE-2026-108851 phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

PT-2026-110170

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.11 Description An authorization flaw exists in the MCP server faq search tool. This occurs because the searchDatabase function fails to apply user or group permission checks. Consequently, clients connected to th...

phpMyFAQ StopWords Method Compromise

The vulnerability of the StopWords::add method in the phpMyFAQ web application’s file phpMyFAQ/src/phpMyFAQ/StopWords.php relates to the lack of measures taken to protect the SQL query structure when processing the word parameter. Exploiting this vulnerability allows an attacker to compromise the...

phpMyFAQ ChatController XSS

The vulnerability in the phpMyFAQ application’s file phpMyFAQ/src/phpMyFAQ/Controller/Frontend/Api/ChatController.php is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to disclose sensitive information...

phpMyFAQ XSS

The vulnerability of the htmlentitydecode function in the phpMyFAQ/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php file of the phpMyFAQ web application is related to the lack of security measures for the website’s structure. Exploiting this vulnerability could allow an attacker to perform...

phpMyFAQ TwoFactorSuccess Unauthorized Access

The vulnerability of the twoFactorSuccess function in the phpMyFAQ web application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

GHSA-RW77-VQ4G-X3HP phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

Improper Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

Improper Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Authentication via the check endpoint, which allows authentication based solely on a valid 6-digit TOTP token and a user-chosen user-id, withou...

GHSA-8GPW-XVPF-HVX5 phpMyFAQ's two-factor authentication login bypasses the password factor

Summary The public two-factor verification endpoint POST /check logs a user in based solely on a valid 6-digit TOTP token and a chosen user-id. It does not require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker...

phpMyFAQ's two-factor authentication login bypasses the password factor

Summary The public two-factor verification endpoint POST /check logs a user in based solely on a valid 6-digit TOTP token and a chosen user-id. It does not require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker...

GHSA-PGWP-VC7Q-CVJ3 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Summary A stored cross-site scripting XSS vulnerability in phpMyFAQ allows any unauthenticated user or low-privileged registered user to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeove...

CVE-2026-47132

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-56738

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...