| phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionCVE-2026-56738 · GHSA-RW77-VQ4G-X3HP |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ's two-factor authentication login bypasses the password factorCVE-2026-56737 · GHSA-8GPW-XVPF-HVX5 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionCVE-2026-56736 · GHSA-PGWP-VC7Q-CVJ3 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ: IDOR Account Takeover CVE-2026-35671 · GHSA-XVP4-PHQJ-CJR3 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fieldsCVE-2026-46359 · GHSA-PM8C-3QQ3-72W7 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQCVE-2026-45009 · GHSA-JRC5-W569-H7H5 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ: Default Empty API Token Authentication BypassCVE-2026-35672 · GHSA-GP95-J463-VV28 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission CheckCVE-2026-46362 · GHSA-HPGW-WW76-C68R |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin adminsCVE-2026-45008 · GHSA-GH9P-Q46P-57G2 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() SanitizationCVE-2026-46363 · GHSA-F5P7-2C9Q-8896 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ has stored XSS via Utils::parseUrl() in comment renderingCVE-2026-46367 · GHSA-9525-27VJ-C8R8 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token ValidationCVE-2026-35676 · GHSA-9QV9-8XV6-5P35 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guardsCVE-2026-56396 · GHSA-985R-Q3QP-299H |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)CVE-2026-49205 · GHSA-8C6H-7G6X-M5X4 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ has Weak Cryptography - SHA1 for Password HashingCVE-2026-48488 · GHSA-58FG-62FG-3FCJ |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
کم
|
اصلاح گزارش شده |
|
| phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSSCVE-2026-46360 · GHSA-WHQH-9PQ5-C7R3 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated UserCVE-2026-45007 · GHSA-RM98-82FR-MCFX |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result RenderingCVE-2026-46361 · GHSA-PQH6-8FXF-JX22 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
متوسط
|
اصلاح گزارش شده |
|
| phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email EnumerationCVE-2026-35675 · GHSA-W9XH-5F39-VQ89 |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
زیاد
|
اصلاح گزارش شده |
|
| phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-idCVE-2026-45010 · GHSA-9PQ7-MFWH-XX2J |
phpmyfaq/phpmyfaqthorsten/phpmyfaq |
Composer |
بحرانی
|
اصلاح گزارش شده |
|
