173724 matches found
EUVD-2026-62448
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...
CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...
CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2026-76208
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass in AuthLdap::create(). When LDAP authentication is enabled, a successful LDAP bind unconditionally calls User::setStatus('active'), overwriting a pre-existing local account's status from blocked to active . This allows an admi...
CVE-2026-76207 phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...
CVE-2026-76207
phpMyFAQ before 4.1.7 issues remember-me cookies before 2FA verification, allowing attackers with valid credentials to skip the 2FA challenge and replay the cookie for full authenticated access. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade to 4.1.7; advisory at https://github.com/...
CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
CVE-2026-75919 phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
EUVD-2026-62444
phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...
CVE-2026-75919
phpMyFAQ before 4.1.7 has an authentication bypass in SetupController. Unauthenticated attackers can call POST /api/setup/update-database and POST /api/setup/backup while maintenance mode is enabled to run database migrations, disable maintenance mode, and extract database credentials from genera...
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CGA-F8FR-G9GW-GWRH
Bulletin has no description...
MINI-MQV9-RMJ2-85J2
Bulletin has no description...
MINI-FQXW-MRRQ-3Q23
Bulletin has no description...
MINI-MVG3-J5PC-6JM5
Bulletin has no description...
MINI-R86X-8JJM-CPHQ
Bulletin has no description...