Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

Missing Critical Step in Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

Missing Critical Step in Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

Brute Force

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...

Replay Attack

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Replay Attack through improper handling of the prepareForLogin process. An attacker can gain unauthorized access by replaying a previously captured...

Replay Attack

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Replay Attack through improper handling of the prepareForLogin process. An attacker can gain unauthorized access by replaying a previously captured...

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the API endpoints for comments and attachments. An attacker can access restricted comment text, commenter email addresses, and...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the API endpoints for comments and attachments. An attacker can access restricted comment text, commenter email addresses, and...

Missing Authentication for Critical Function

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SetupController process. An attacker can perform unauthorized database migrations, create...

Missing Authentication for Critical Function

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SetupController process. An attacker can perform unauthorized database migrations, create...

CVE-2026-76214

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...

CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

CVE-2026-76209

phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when registration is disabled. Attackers can bypass the registration restriction by submitting requests to POST /api/register or POST...

CVE-2026-76210

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...