phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha

phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint

phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ - Insecure Direct Object Reference in User Password API

phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

phpMyFAQ before 4.1.7 SQL Injection via Glossary

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering

phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ - Authentication Bypass via Empty API Token

phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass

phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint

phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check

phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data