phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint

phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)

phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check

phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user

phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes

User Removal Page Allows Spoofing Of User Details

phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor

phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

phpMyFAQ Stored HTML Injection at contentLink

phpMyFAQ vulnerable to stored XSS on attachments filename

Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

phpMyFAQ - Missing Authorization in Tag Deletion Endpoint

phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass

phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer

phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation

phpMyFAQ Stored XSS at FAQ News Content

phpMyFAQ Stored XSS at user email

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL

phpMyFAQ before 4.1.7 Information Disclosure via PDF Export

phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before 4.1.7 Authentication Bypass via Setup API

phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching