phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint

phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check

phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

phpMyFAQ - Missing Authorization in Tag Deletion Endpoint

phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass

phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer

phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL

phpMyFAQ before 4.1.7 Information Disclosure via PDF Export

phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before 4.1.7 Authentication Bypass via Setup API

phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard

phpMyFAQ before 4.1.7 Information Disclosure via Admin API

phpMyFAQ before v4.1.6 Registration Bypass via API

phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints

phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure