Composer thorsten/phpmyfaq has 112 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-3766 | phpMyFAQ vulnerable to reflected Cross-site Scripting | medium | 6.1 | <3.1.8 | 3.1.8 |
| CVE-2022-4407 | phpMyFAQ vulnerable to Cross-site Scripting | medium | 6.1 | <3.1.9 | 3.1.9 |
| CVE-2024-55889 | thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames | medium | 4.9 | <3.2.10 | 3.2.10 |
| CVE-2025-69200 | phpMyFAQ has unauthenticated config backup download via /api/setup/backup | high | 7.5 | <4.0.16 or >=4.1.0-alpha and <=4.1.0-beta.2 | 4.0.16 |
| CVE-2026-24421 | phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) | medium | 6.5 | <4.0.17 | 4.0.17 |
| CVE-2026-46364 | phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha | critical | 9.8 | <4.1.2 | 4.1.2 |
| CVE-2023-0789 | Command Injection in thorsten/phpmyfaq | critical | 9.8 | <3.1.11 | 3.1.11 |
| CVE-2023-1880 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter | high | 8.3 | <3.1.12 | 3.1.12 |
| CVE-2022-3754 | phpMyFAQ contains Weak Password Requirements | critical | 9.8 | <3.1.8 | 3.1.8 |
| CVE-2022-3608 | phpMyFAQ vulnerable to Cross-site Scripting | high | 8.4 | <3.2.0-alpha | 3.2.0-alpha |
| CVE-2023-5863 | phpMyFAQ Cross-site Scripting vulnerability | medium | 6.1 | <3.2.2 | 3.2.2 |
| CVE-2023-0311 | phpMyFAQ Improper Authentication vulnerability | critical | 9.8 | <3.1.10 | 3.1.10 |
| CVE-2023-0788 | Code Injection in thorsten/phpmyfaq | critical | 9.8 | <3.1.11 | 3.1.11 |
| CVE-2023-1762 | thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management | high | 8.8 | <3.1.12 | 3.1.12 |
| CVE-2023-1886 | thorsten/phpmyfaq vulnerable to authentication bypass | high | 7.3 | <3.1.12 | 3.1.12 |
| CVE-2023-4006 | phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability | high | 8.8 | <3.1.16 | 3.1.16 |
| CVE-2025-62519 | phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | high | 7.2 | <4.0.14 | 4.0.14 |
| CVE-2022-3765 | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | <3.1.8 | 3.1.8 |
| CVE-2023-1753 | phpMyFAQ has weak password requirements | medium | 5.5 | <3.1.12 | 3.1.12 |
| CVE-2023-0790 | Uncaught Exception in thorsten/phpmyfaq | high | 8.8 | <3.1.11 | 3.1.11 |
| CVE-2023-0793 | Weak Password Requirements in thorsten/phpmyfaq | high | 8.8 | <3.1.11 | 3.1.11 |
| CVE-2023-1887 | thorsten/phpmyfaq vulnerable to business logic errors | high | 8.3 | <3.1.12 | 3.1.12 |
| CVE-2023-0307 | phpMyFAQ has Weak Password Requirements | medium | 0.0 | <3.1.10 | 3.1.10 |
| CVE-2023-0792 | Code Injection in thorsten/phpmyfaq | medium | 5.4 | <3.1.11 | 3.1.11 |
| CVE-2023-5227 | phpMyFAQ allows unrestricted file types in image field | medium | 6.5 | <3.1.18 | 3.1.18 |
| CVE-2023-1755 | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | <3.1.12 | 3.1.12 |
| CVE-2023-0880 | Misinterpretation of Input in thorsten/phpmyfaq | medium | 4.3 | <3.1.11 | 3.1.11 |
| CVE-2023-0786 | Cross-site Scripting in thorsten/phpmyfaq | medium | 4.8 | <3.1.11 | 3.1.11 |
| CVE-2023-1754 | phpMyFAQ vulnerable to improper input validation | medium | 4.7 | <3.1.12 | 3.1.12 |
| CVE-2023-0312 | thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS) | medium | 6.1 | <3.1.10 | 3.1.10 |
| CVE-2023-5320 | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.0 | <3.1.18 | 3.1.18 |
| CVE-2023-5865 | Insufficient Session Expiration in thorsten/phpmyfaq | high | 7.6 | <3.2.2 | 3.2.2 |
| CVE-2023-3469 | phpMyFAQ Cross-site Scripting | medium | 5.2 | <3.2.0-beta.2 | 3.2.0-beta.2 |
| CVE-2023-0310 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | <3.1.10 | 3.1.10 |
| CVE-2023-0306 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | <3.1.10 | 3.1.10 |
| CVE-2023-2428 | phpMyFAQ vulnerable to Stored Cross-site Scripting | medium | 6.1 | <3.1.13 | 3.1.13 |
| CVE-2023-0791 | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | <3.1.11 | 3.1.11 |
| CVE-2023-0794 | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | <3.1.11 | 3.1.11 |
| CVE-2023-2753 | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | <3.2.0-beta | 3.2.0-beta |
| CVE-2023-2752 | phpMyFAQ vulnerable to stored Cross-site Scripting | medium | 5.4 | <3.2.0-beta | 3.2.0-beta |
| CVE-2023-53929 | phpMyFAQ contains a CSV injection vulnerability | high | 8.8 | <=3.1.12 | – |
| CVE-2023-1878 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog | high | 8.3 | <3.1.12 | 3.1.12 |
| CVE-2023-0314 | phpMyFAQ Reflected Cross-site Scripting vulnerability | medium | 6.1 | <3.1.10 | 3.1.10 |
| CVE-2023-1758 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) in FAQ comment username parameter | high | 8.9 | <3.1.12 | 3.1.12 |
| CVE-2023-2429 | phpMyFAQ Improper Access Control vulnerability | medium | 6.6 | <3.1.13 | 3.1.13 |
| CVE-2023-0787 | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | <3.1.11 | 3.1.11 |
| CVE-2023-1757 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter | high | 8.1 | <3.1.12 | 3.1.12 |
| CVE-2023-1882 | thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter | high | 8.1 | <3.1.12 | 3.1.12 |
| CVE-2023-5864 | phpMyFAQ Cross-site Scripting vulnerability | high | 7.4 | <3.2.1 | 3.2.1 |
| CVE-2023-1760 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | <3.1.12 | 3.1.12 |
| CVE-2026-56737 | phpMyFAQ's two-factor authentication login bypasses the password factor | high | 8.1 | >=3.2.0 and <4.1.6 | 4.1.6 |
| CVE-2023-2998 | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.0 | <3.1.14 | 3.1.14 |
| CVE-2022-4408 | phpMyFAQ vulnerable to Cross-site Scripting | medium | 5.4 | <3.1.9 | 3.1.9 |
| CVE-2023-0308 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | <3.1.10 | 3.1.10 |
| CVE-2023-0309 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | <3.1.10 | 3.1.10 |
| CVE-2018-16650 | phpMyFAQ CSRF | high | 8.8 | <2.9.11 | 2.9.11 |
| CVE-2024-54141 | phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | high | 8.6 | <4.0.0 | 4.0.0 |
| CVE-2023-4007 | phpMyFAQ Stored Cross-site Scripting vulnerability | high | 8.8 | <3.1.16 | 3.1.16 |
| CVE-2023-1883 | thorsten/phpmyfaq vulnerable to improper access control | medium | 5.4 | <3.1.12 | 3.1.12 |
| CVE-2026-35672 | phpMyFAQ: Default Empty API Token Authentication Bypass | high | 7.5 | <4.1.3 | 4.1.3 |
| CVE-2023-2999 | thorsten/phpmyfaq vulnerable to cross-site scripting | medium | 6.7 | <3.1.14 | 3.1.14 |
| CVE-2023-5316 | phpMyFAQ Cross-site Scripting vulnerability | critical | 9.1 | <3.1.18 | 3.1.18 |
| CVE-2023-5319 | phpMyFAQ Cross-site Scripting vulnerability | high | 8.3 | <3.1.18 | 3.1.18 |
| CVE-2023-1885 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter | medium | 6.3 | <3.1.12 | 3.1.12 |
| CVE-2023-1761 | phpMyFAQ Code Injection vulnerability | medium | 5.4 | <3.1.12 | 3.1.12 |
| CVE-2023-1875 | Cross-site Scripting in thorsten/phpmyfaq | medium | 5.4 | <3.1.12 | 3.1.12 |
| CVE-2023-1879 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter | medium | 4.7 | <3.1.12 | 3.1.12 |
| CVE-2023-2427 | Cross Site Scripting in thorsten/phpmyfaq | medium | 6.1 | <3.1.13 | 3.1.13 |
| CVE-2023-1759 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 4.8 | <3.1.12 | 3.1.12 |
| CVE-2023-1756 | thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export | medium | 4.7 | <3.1.12 | 3.1.12 |
| CVE-2023-6889 | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | <3.1.17 | 3.1.17 |
| CVE-2023-6890 | phpMyFAQ Cross-site Scripting vulnerability | medium | 5.4 | <3.1.17 | 3.1.17 |
| CVE-2023-2550 | Cross Site Scripting in thorsten/phpmyfaq | high | 8.2 | <3.1.13 | 3.1.13 |
| CVE-2022-4409 | phpMyFAQ has insecure HTTP cookies | high | 7.5 | <3.1.9 | 3.1.9 |
| CVE-2026-24420 | phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) | medium | 6.5 | <4.0.17 | 4.0.17 |
| CVE-2026-27836 | phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint | high | 7.5 | <4.0.18 | 4.0.18 |
| CVE-2023-1884 | thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter | medium | 4.7 | <3.1.12 | 3.1.12 |
| CVE-2026-57995 | phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold | high | 8.8 | <4.1.5 | 4.1.5 |
| CVE-2026-56396 | phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards | high | 8.1 | <4.1.4 | 4.1.4 |
| CVE-2026-45010 | phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id | critical | 9.1 | <4.1.2 | 4.1.2 |
| CVE-2024-56199 | phpMyFAQ Vulnerable to Stored HTML Injection at FAQ | medium | 5.2 | >=3.2.10 and <=4.0.1 | – |
| CVE-2023-0313 | phpMyFAQ Stored Cross-site Scripting vulnerability | medium | 5.4 | <3.1.10 | 3.1.10 |
| CVE-2026-35675 | phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | high | 8.2 | <4.1.3 | 4.1.3 |
| CVE-2025-59943 | phpMyFAQ duplicate email registration allows multiple accounts with the same email | high | 8.1 | >=4.0.7 and <4.0.13 | 4.0.13 |
| CVE-2023-5867 | Cross-site Scripting (XSS) in thorsten/phpmyfaq | medium | 5.4 | <3.2.2 | 3.2.2 |
| CVE-2026-24422 | phpMyFAQ: Public API endpoints expose emails and invisible questions | medium | 5.3 | <4.0.17 | 4.0.17 |
| CVE-2026-57961 | phpMyFAQ has Potential Authenticated Path Traversal in PDF Export | medium | 4.9 | >=4.0.0-alpha and <4.1.5 | 4.1.5 |
| CVE-2023-5317 | phpMyFaq Cross-site Scripting vulnerability | medium | 6.3 | <3.1.18 | 3.1.18 |
| CVE-2026-49205 | phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) | medium | 6.5 | <4.1.4 | 4.1.4 |
| CVE-2026-35671 | phpMyFAQ: IDOR Account Takeover | high | 8.8 | <4.1.3 | 4.1.3 |
| CVE-2026-57994 | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | >=4.1.0 and <4.1.5 | 4.1.5 |
| CVE-2026-46366 | phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query | high | 7.5 | <4.1.2 | 4.1.2 |
| CVE-2026-34973 | phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | medium | 5.3 | <4.1.1 | 4.1.1 |
| CVE-2026-46362 | phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check | medium | 6.5 | <4.1.2 | 4.1.2 |
| CVE-2026-35676 | phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation | high | 8.2 | <4.1.3 | 4.1.3 |
| CVE-2026-46361 | phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering | medium | 6.9 | <4.1.2 | 4.1.2 |
| CVE-2023-5866 | Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq | medium | 6.3 | <3.2.1 | 3.2.1 |
| CVE-2025-68951 | phpMyFAQ has Stored XSS in user list via admin-managed display_name | medium | 5.4 | >=4.0.14 and <4.0.16 | 4.0.16 |
| CVE-2026-45008 | phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins | medium | 6.5 | <4.1.2 | 4.1.2 |
| CVE-2026-46359 | phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields | high | 7.5 | <4.1.2 | 4.1.2 |
| CVE-2026-32629 | phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor | medium | 0.0 | <4.1.1 | 4.1.1 |
| CVE-2026-45007 | phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Auth | medium | 4.3 | <4.1.2 | 4.1.2 |
| CVE-2026-56738 | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion | high | 0.0 | <4.1.6 | 4.1.6 |
| CVE-2026-47132 | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | medium | 5.4 | <4.2.0-alpha | 4.2.0-alpha |
| CVE-2026-46367 | phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering | high | 7.6 | >=4.1.1 and <4.1.2 | 4.1.2 |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | high | 8.2 | <4.2.0-alpha | 4.2.0-alpha |
| CVE-2026-46365 | phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags | medium | 5.4 | <4.1.2 | 4.1.2 |
| CVE-2026-45009 | phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ | medium | 4.3 | >=4.1.1 and <4.1.2 | 4.1.2 |
| CVE-2026-46360 | phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS | medium | 5.4 | <4.1.2 | 4.1.2 |
| CVE-2026-46363 | phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization | medium | 5.4 | <4.1.2 | 4.1.2 |
| CVE-2026-48488 | phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing | low | 0.0 | <4.1.4 | 4.1.4 |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation | medium | 5.4 | <4.1.1 | 4.1.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked