Security
English
همهٔ محصولات

thorsten/phpmyfaq

Composer · بسته
112 گزارش
اطلاع‌رسانی آسیب‌پذیری
دنبال‌کردن
گزارشمحصولاکوسیستمشدتوضعیت اصلاحآخرین تغییر
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionCVE-2026-56738 · GHSA-RW77-VQ4G-X3HP phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ's two-factor authentication login bypasses the password factorCVE-2026-56737 · GHSA-8GPW-XVPF-HVX5 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionCVE-2026-56736 · GHSA-PGWP-VC7Q-CVJ3 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationCVE-2026-47132 · GHSA-6PVM-2VJJ-RX4W thorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ: IDOR Account Takeover CVE-2026-35671 · GHSA-XVP4-PHQJ-CJR3 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fieldsCVE-2026-46359 · GHSA-PM8C-3QQ3-72W7 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQCVE-2026-45009 · GHSA-JRC5-W569-H7H5 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ: Default Empty API Token Authentication BypassCVE-2026-35672 · GHSA-GP95-J463-VV28 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission CheckCVE-2026-46362 · GHSA-HPGW-WW76-C68R phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin adminsCVE-2026-45008 · GHSA-GH9P-Q46P-57G2 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() SanitizationCVE-2026-46363 · GHSA-F5P7-2C9Q-8896 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ has stored XSS via Utils::parseUrl() in comment renderingCVE-2026-46367 · GHSA-9525-27VJ-C8R8 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token ValidationCVE-2026-35676 · GHSA-9QV9-8XV6-5P35 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guardsCVE-2026-56396 · GHSA-985R-Q3QP-299H phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)CVE-2026-49205 · GHSA-8C6H-7G6X-M5X4 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ has Weak Cryptography - SHA1 for Password HashingCVE-2026-48488 · GHSA-58FG-62FG-3FCJ phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer کم اصلاح گزارش شده
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSSCVE-2026-46360 · GHSA-WHQH-9PQ5-C7R3 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated UserCVE-2026-45007 · GHSA-RM98-82FR-MCFX phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result RenderingCVE-2026-46361 · GHSA-PQH6-8FXF-JX22 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer متوسط اصلاح گزارش شده
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email EnumerationCVE-2026-35675 · GHSA-W9XH-5F39-VQ89 phpmyfaq/phpmyfaqthorsten/phpmyfaq Composer زیاد اصلاح گزارش شده