CVE-2026-66397

CVE-2026-66397 affects phpMyFAQ prior to 4.1.6. It fails to validate path traversal in the existing_image field during category updates, allowing an authenticated user to delete arbitrary files via Image::delete(), including the database.php config file. This can disable the installation gate and...

CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

CVE-2026-57996 phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USERADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and...

EUVD-2026-21384

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the fklevelslist parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass...

PT-2026-31926

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f k levels list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass...