thorsten phpMyFAQ vulnerabilities

CVEs per yearBy the year they were published

1. 202413
2. 20255
3. 202691

Newest CVEs

• CVE-2026-124433

  phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController

  thorsten · phpMyFAQ

  High7.0
• CVE-2026-124432

  phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login

  thorsten · phpMyFAQ

  Medium6.9
• CVE-2026-116183

  phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

  thorsten · phpMyFAQ

  High8.7
• CVE-2026-116182

  phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

  thorsten · phpMyFAQ

  Medium5.3
• CVE-2026-111911

  phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

  thorsten · phpMyFAQ

  Critical9.3
• CVE-2026-111910

  phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

  thorsten · phpMyFAQ

  High7.1
• CVE-2026-111909

  phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

  thorsten · phpMyFAQ

  High7.2
• CVE-2026-111908

  phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

  thorsten · phpMyFAQ

  High8.7
• CVE-2026-111907

  phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

  thorsten · phpMyFAQ

  High7.1
• CVE-2026-111906

  phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

  thorsten · phpMyFAQ

  High7.1