Product by Thorsten

    phpMyFAQ

    176 known vulnerabilities in phpMyFAQ (Thorsten), 0 of them actively exploited (CISA KEV).

    Key figures

    176

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    24

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in phpMyFAQ (Thorsten)
    CriticalCVE-2022-4407

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    also in 2 other products

    		9.8
    CriticalCVE-2026-46364

    phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

    		9.8
    HighCVE-2022-3766

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    also in 2 other products

    		7.3
    HighCVE-2025-69200

    phpMyFAQ has unauthenticated config backup download via /api/setup/backup

    also in 1 other product

    		7.5
    CriticalCVE-2026-111911

    phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

    		9.8
    MediumCVE-2026-24421

    phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

    also in 1 other product

    		6.5
    HighCVE-2023-1880

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    also in 2 other products

    		8.3
    CriticalCVE-2023-0789

    Command Injection in thorsten/phpmyfaq

    also in 2 other products

    		8.1
    HighCVE-2024-55889

    phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

    also in 1 other product

    		4.9
    HighCVE-2026-56737

    phpMyFAQ's two-factor authentication login bypasses the password factor

    		8.1
    CriticalCVE-2022-3754

    Weak Password Requirements in thorsten/phpmyfaq

    also in 2 other products

    		7.5
    HighCVE-2024-27299

    phpMyFAQ SQL Injection at "Save News"

    also in 1 other product

    		8.8
    HighCVE-2024-28105

    phpMyFAQ's File Upload Bypass at Category Image Leads to RCE

    also in 1 other product

    		7.2
    HighCVE-2026-111901

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

    		7.5
    HighCVE-2026-75918

    phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

    also in 1 other product

    		8.8
    CriticalCVE-2026-109573

    phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

    		8.1
    HighCVE-2026-111882

    Thorsten phpMyFAQ: Improper Authentication

    		8.1
    CriticalCVE-2026-76213

    phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

    also in 1 other product

    		7.4
    HighCVE-2026-111908

    phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

    		8.3
    HighCVE-2026-111884

    Thorsten phpMyFAQ: Use of Single-factor Authentication

    		8.3
    HighCVE-2026-111898

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

    		7.5
    HighCVE-2026-111893

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API

    		6.5
    HighCVE-2026-76208

    phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

    also in 1 other product

    		8.2
    HighCVE-2024-28107

    phpMyFAQ SQL injections at insertentry & saveentry

    also in 1 other product

    		8.8
    HighCVE-2026-76207

    phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

    also in 1 other product

    		8.1

    All vulnerabilities in search

    All products by Thorsten