phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ - Insecure Direct Object Reference in User Password API

phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

phpMyFAQ before 4.1.7 SQL Injection via Glossary

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering

phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

phpMyFAQ - Authentication Bypass via Empty API Token

phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass

phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

phpMyFAQ: Public API endpoints expose emails and invisible questions

phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable