phpMyFAQ is an open source FAQ web application

Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2

Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8

Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16

Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12

Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11

Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10

Weak Password Requirements in thorsten/phpmyfaq

phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly

phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions

phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases

Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11

Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11

phpMyFAQ before 2.9.11 allows CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1)…

In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary

Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

phpMyFAQ before 4.1.7 SQL Injection via Glossary

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names

phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

phpMyFAQ is an open source FAQ web application

phpMyFAQ is an open source FAQ web application

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9

phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ is an open source FAQ web application

phpMyFAQ is an open source FAQ web application

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports