Medium
CVE-2026-46365
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 121
Reset filters
Medium
CVE-2026-46362
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
High
CVE-2026-46367
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Medium
CVE-2026-34974
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
Medium
CVE-2026-34973
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Medium
CVE-2026-32629
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
High
CVE-2026-27836
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
Medium
CVE-2026-24422
phpMyFAQ: Public API endpoints expose emails and invisible questions
Medium
CVE-2026-24421
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
Medium
CVE-2026-24420
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
Medium
CVE-2025-68951
phpMyFAQ has Stored XSS in user list via admin-managed display_name
Medium
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
High
CVE-2025-62519
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
High
CVE-2025-59943
phpMyFAQ duplicate email registration allows multiple accounts with the same email
Medium
CVE-2024-56199
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
Medium
CVE-2024-55889
thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames
High
CVE-2024-54141
phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available
Medium
CVE-2024-27300
phpMyFAQ stored Cross-site Scripting at user email
High
CVE-2024-28105
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
Medium
CVE-2024-28106
phpMyFAQ Stored Cross-site Scripting at FAQ News Content
High
CVE-2024-28107
phpMyFAQ SQL injections at insertentry & saveentry
Medium
CVE-2024-28108
phpMyFAQ Stored HTML Injection at contentLink
Medium
CVE-2024-29179
phpMyFAQ Stored Cross-site Scripting at File Attachments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.