Login Request a demo
PH
Product
phpMyFAQ
by phpMyFAQ · last CVE Aug 19, 2026
159
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities159In the news0Timeline
Severity mix
Critical 13High 38Medium 86Low 3
Severity
All severities159Critical13High38Medium86Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add phpMyFAQ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-0791
5.4
1%
Feb 12
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11
Affected: before 3.1.11
CVE-2023-0787
5.4
1%
Feb 12
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11
Affected: before 3.1.11
CVE-2023-0313
5.4
0%
Jan 15
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10
Affected: before 3.1.10
CVE-2023-0310
5.4
1%
Jan 15
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10
Affected: before 3.1.10
CVE-2023-0309
5.4
1%
Jan 15
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10
Affected: before 3.1.10
CVE-2023-0308
5.4
1%
Jan 15
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10
Affected: before 3.1.10
CVE-2023-0306
5.4
1%
Jan 15
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10
Affected: before 3.1.10
CVE-2022-4408
5.4
1%
Dec 11
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9
Affected: before 3.1.9
CVE-2022-3765
5.4
1%
Oct 31
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Affected: before 3.1.8
CVE-2017-15727
5.4
2%
Oct 22
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment
Affected: through 2.9.8
CVE-2026-76215
5.3
0%
Aug 19
phpMyFAQ before 4.1.7 Missing Authorization via child resources
Affected: before 4.1.7
CVE-2026-76212
5.3
0%
Aug 19
phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
Affected: before 4.1.7
CVE-2026-76206
5.3
0%
Aug 19
phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
Affected: before 4.1.7
CVE-2026-75920
5.3
0%
Aug 19
phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
Affected: before 4.1.6
CVE-2026-75919
5.3
1%
Aug 19
phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
Affected: before 4.1.7
CVE-2026-57994
5.3
0%
Jul 10
phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints
Affected: 4.1.0 before 4.1.5
CVE-2026-34973
5.3
0%
Apr 2
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Affected: 4.1.0
CVE-2014-6050
5.3
5%
Aug 28
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request
Affected: before 2.8.13
CVE-2014-6048
5.3
6%
Aug 28
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request
Affected: before 2.8.13
CVE-2014-6047
5.3
6%
Aug 28
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks
Affected: before 2.8.13
CVE-2004-2257
5.3
2%
Dec 31
phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request
Affected: 1.4.0
CVE-2026-34729
4.8
0%
Apr 2
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
Affected: before 4.1.1
CVE-2024-29179
4.8
1%
Mar 25
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
Affected: 3.2.5
CVE-2023-5864
4.8
1%
Oct 31
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1
Affected: before 3.2.1
CVE-2023-3469
4.8
1%
Jun 30
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2
Affected: through 3.1.14; 3.2.0; 3.2.0
CVE-2023-2550
4.8
0%
May 5
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13
Affected: before 3.1.13
CVE-2023-2427
4.8
0%
May 5
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13
Affected: before 3.1.13
CVE-2023-1760
4.8
1%
Mar 31
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12
Affected: before 3.1.12
CVE-2023-1759
4.8
0%
Mar 31
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12
Affected: before 3.1.12
CVE-2023-0786
4.8
1%
Feb 12
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11
Affected: before 3.1.11
CVE-2017-15728
4.8
1%
Oct 22
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords
Affected: through 2.9.8
CVE-2017-14618
4.8
2%
Sep 20
Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an…
Affected: through 2.9.8
CVE-2023-1754
4.7
1%
Mar 31
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12
Affected: before 3.1.12
CVE-2026-76211
4.3
0%
Aug 19
phpMyFAQ before 4.1.7 Information Disclosure via Admin API
Affected: before 4.1.7
CVE-2026-76209
4.3
0%
Aug 19
phpMyFAQ before v4.1.6 Registration Bypass via API
Affected: before 4.1.6
CVE-2023-1887
4.3
1%
Apr 5
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12
Affected: before 3.1.12
CVE-2023-0880
4.3
1%
Feb 17
Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11
Affected: before 3.1.11
CVE-2026-57961
2.7
0%
Jul 10
phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function
Affected: before 4.1.5
CVE-2024-29196
2.7
1%
Mar 26
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
Affected: 3.2.5
CVE-2014-6049
2.7
3%
Aug 28
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter
Affected: before 2.8.13
CVE-2014-0814
–
2%
Feb 14
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
Affected: through 2.8.5; 1.0; 1.0.1; 1.0.1a; 1.1.0; 1.1.1; +34 more
CVE-2014-0813
–
1%
Feb 14
Cross-site request forgery (CSRF) vulnerability in phpMyFAQ before 2.8.6 allows remote attackers to hijack the authentication of arbitrary users for requests that modify settings
Affected: through 2.8.5; 1.0; 1.0.1; 1.0.1a; 1.1.0; 1.1.1; +34 more
CVE-2010-4821
–
5%
Oct 22
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php
Affected: through 2.6.8; 1.0; 1.0.1; 1.0.1a; 1.1.0; 1.1.1; +34 more
CVE-2011-4825
–
39%
Dec 15
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before…
Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +14 more
CVE-2011-3783
–
1%
Sep 24
phpMyFAQ 2.6.13 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as…
Affected: 2.6.13
CVE-2010-4558
–
1%
Dec 17
phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in…
Affected: 2.6.11; 2.6.12
CVE-2009-4780
–
1%
Apr 21
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter…
Affected: through 2.5.4; 0.60; 0.65; 0.70; 0.80; 0.80a; +34 more
CVE-2009-4040
–
1%
Nov 20
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web…
Affected: through 2.0.16; 0.60; 0.65; 0.70; 0.80; 0.80a; +34 more
CVE-2007-1032
–
1%
Feb 21
Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files on the server."
Affected: through 1.6.9; 0.60; 0.65; 0.70; 0.80; 0.80a; +34 more
CVE-2006-6912
–
1%
Dec 31
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename…
Affected: through 1.6.7
Page 3 of 4 · 159 total
1234