SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...

PT-2026-76560

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.2.0-alpha Description An authenticated SQL LIKE wildcard injection exists in the chat user search functionality. This issue allows any logged-in user to bypass the intended display-name search filter and enumerate...

PT-2026-75937

Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and , which remain active LIKE...

phpMyFAQ - Unauth Config Backup Detection (CVE-2025-69200)

phpMyFAQ = 4.1.0-RC / 4.0.16 allows unauthenticated POST /api/setup/backup to generate and expose a configuration ZIP containing database credentials CVE-2025-69200 / GHSA-9cg9-4h4f-j6fg. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ unauthenticated config backup via /api/setup/backup...

phpMyFAQ - Compromised Package Backdoor RCE (CVE-2010-4558)

Exploits CVE-2010-4558 by sending base64 PHP via phpmyfaqnew parameter. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor RCE CVE-2010-4558.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class...

phpMyFAQ - Compromised Package Backdoor Detection (CVE-2010-4558)

Detects CVE-2010-4558 via index.php?phpmyfaqnew=cGhwaW5mbygpOwo= phpinfo;. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor CVE-2010-4558.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyFAQ -...

phpMyFAQ - Unauth Config Backup Download (CVE-2025-69200)

Triggers POST /api/setup/backup without authentication and downloads the generated configuration ZIP may contain database.php credentials — CVE-2025-69200. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ unauthenticated config backup download CVE-2025-69200.""" import json import re from...

CVE-2026-56736

creationtimestamp| type| source ---|---|--- 2026-08-08 13:30:59+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3...

PT-2026-78385

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An authentication bypass exists in the SetupController when maintenance mode is enabled. This allows unauthenticated remote attackers to execute database migrations and create configuration backups...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim. The brute-force throttle protecting the administration two-factor prompt is scoped to the...

PT-2026-78384

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient protection of service data in the userTracking function of the UserSession class within the src/phpMyFAQ/User/UserSession.php file allows remote attackers to gain unauthorized access to...

PT-2026-78389

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description A two-factor authentication 2FA bypass exists because remember-me tokens are issued before the 2FA verification process is completed. An attacker possessing valid credentials can obtain a remember-m...

PT-2026-78386

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description The software writes content backup ZIP archives to the web-accessible document root at the endpoint 'content.zip', which exposes sensitive files such as database credentials. Unauthenticated attacke...

Phpmyfaq v3.1.11 - Cross-Site Scripting Detection

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized. !/usr/bin/env python3 -- coding: utf-8 -- """Phpmyfaq v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

phpMyFAQ < 3.2.0 - Cross-site Scripting Detection

Cross-site Scripting XSS Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS Reflected in GitHub repository thorsten/phpmyfaq prior to 3.""" from kittysploit import from lib.protocols.http.httpclient import...

phpMyFAQ < 3.1.8 - Cross-Site Scripting Detection

phpMyFAQ versions prior to 3.1.8 contain a reflected cross-site scripting vulnerability in the search functionality. The application fails to properly sanitize user input in the search parameter, allowing attackers to inject and execute malicious JavaScript code in the context of other users'...

phpMyFAQ Installation - Exposure Detection

phpMyFAQ installation is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ installation is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyFAQ Installation - Exposure Detection',...

Directory Traversal

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the existingimage field during category updates. An attacker can delete arbitrary files by exploiti...

Directory Traversal

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the existingimage field during category updates. An attacker can delete arbitrary files by exploiti...

Resources Downloaded over Insecure Protocol

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol through the configuration API. An attacker can execute arbitrary PHP code by uploading a malicious ZIP file ...