PH
Product
phpMyFAQ
159
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 38Medium 86Low 3
Watch
Add phpMyFAQ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-0787 | 5.4 | Feb 12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11 Affected: before 3.1.11 |
| CVE-2023-0313 | 5.4 | Jan 15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10 Affected: before 3.1.10 |
| CVE-2023-0310 | 5.4 | Jan 15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10 Affected: before 3.1.10 |
| CVE-2023-0309 | 5.4 | Jan 15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10 Affected: before 3.1.10 |
| CVE-2023-0308 | 5.4 | Jan 15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10 Affected: before 3.1.10 |
| CVE-2023-0306 | 5.4 | Jan 15 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10 Affected: before 3.1.10 |
| CVE-2022-4408 | 5.4 | Dec 11 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9 Affected: before 3.1.9 |
| CVE-2022-3765 | 5.4 | Oct 31 | Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq Affected: before 3.1.8 |
| CVE-2017-15727 | 5.4 | Oct 22 | In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment Affected: through 2.9.8 |
| CVE-2026-76215 | 5.3 | Aug 19 | phpMyFAQ before 4.1.7 Missing Authorization via child resources Affected: before 4.1.7 |
| CVE-2026-76212 | 5.3 | Aug 19 | phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL Affected: before 4.1.7 |
| CVE-2026-76206 | 5.3 | Aug 19 | phpMyFAQ before 4.1.7 Information Disclosure via PDF Export Affected: before 4.1.7 |
| CVE-2026-75920 | 5.3 | Aug 19 | phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP Affected: before 4.1.6 |
| CVE-2026-75919 | 5.3 | Aug 19 | phpMyFAQ before 4.1.7 Authentication Bypass via Setup API Affected: before 4.1.7 |
| CVE-2026-57994 | 5.3 | Jul 10 | phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints Affected: 4.1.0 before 4.1.5 |
| CVE-2026-34973 | 5.3 | Apr 2 | phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure Affected: 4.1.0 |
| CVE-2014-6050 | 5.3 | Aug 28 | phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request Affected: before 2.8.13 |
| CVE-2014-6048 | 5.3 | Aug 28 | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request Affected: before 2.8.13 |
| CVE-2014-6047 | 5.3 | Aug 28 | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks Affected: before 2.8.13 |
| CVE-2004-2257 | 5.3 | Dec 31 | phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request Affected: 1.4.0 |
| CVE-2026-34729 | 4.8 | Apr 2 | phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() Affected: before 4.1.1 |
| CVE-2024-29179 | 4.8 | Mar 25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases Affected: 3.2.5 |
| CVE-2023-5864 | 4.8 | Oct 31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1 Affected: before 3.2.1 |
| CVE-2023-3469 | 4.8 | Jun 30 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2 Affected: through 3.1.14; 3.2.0; 3.2.0 |
| CVE-2023-2550 | 4.8 | May 5 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13 Affected: before 3.1.13 |
| CVE-2023-2427 | 4.8 | May 5 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13 Affected: before 3.1.13 |
| CVE-2023-1760 | 4.8 | Mar 31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12 Affected: before 3.1.12 |
| CVE-2023-1759 | 4.8 | Mar 31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12 Affected: before 3.1.12 |
| CVE-2023-0786 | 4.8 | Feb 12 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11 Affected: before 3.1.11 |
| CVE-2017-15728 | 4.8 | Oct 22 | In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords Affected: through 2.9.8 |
| CVE-2017-14618 | 4.8 | Sep 20 | Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an… Affected: through 2.9.8 |
| CVE-2023-1754 | 4.7 | Mar 31 | Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12 Affected: before 3.1.12 |
| CVE-2026-76211 | 4.3 | Aug 19 | phpMyFAQ before 4.1.7 Information Disclosure via Admin API Affected: before 4.1.7 |
| CVE-2026-76209 | 4.3 | Aug 19 | phpMyFAQ before v4.1.6 Registration Bypass via API Affected: before 4.1.6 |
| CVE-2023-1887 | 4.3 | Apr 5 | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12 Affected: before 3.1.12 |
| CVE-2023-0880 | 4.3 | Feb 17 | Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11 Affected: before 3.1.11 |