Phpmyfaq Security Vulnerabilities (CVEs)

This vulnerability in phpMyFAQ exposes sensitive user information through multiple public API endpoints due to insufficient access controls. Attackers...

This vulnerability allows authenticated users without proper permissions to download FAQ attachments in phpMyFAQ due to flawed permission checks. It a...

This vulnerability in phpMyFAQ allows any authenticated user, regardless of permissions, to trigger configuration backups and retrieve the backup file...

This stored XSS vulnerability in phpMyFAQ allows attackers to inject malicious JavaScript into administrator browsers by registering users with specia...

An unauthenticated remote attacker can trigger generation and download of configuration backup ZIP files in vulnerable phpMyFAQ installations. This ex...

CVE-2023-53929 is a CSV injection vulnerability in phpMyFAQ 3.1.12 that allows authenticated users to inject malicious formulas into their profile nam...

An authenticated SQL injection vulnerability in phpMyFAQ allows users with 'Configuration Edit' permissions to execute arbitrary SQL commands. This ca...

phpMyFAQ versions 4.0-nightly-2025-10-03 and below allow multiple user accounts to be registered with the same email address due to missing uniqueness...

This vulnerability allows attackers to inject malicious HTML content into the phpMyFAQ editor, disrupting the user interface and potentially causing d...

phpMyFAQ versions before 4.0.0 expose database credentials in error messages when database connection fails. This allows attackers to obtain sensitive...

This vulnerability in phpMyFAQ allows attackers to upload malicious PHP files by manipulating Content-type and lang parameters during category image u...

A SQL injection vulnerability in phpMyFAQ allows authenticated users with FAQ news editing permissions to execute arbitrary SQL commands. This can lea...

A SQL injection vulnerability in phpMyFAQ's 'Add News' functionality allows authenticated users with news editing permissions to execute arbitrary SQL...

This CVE describes an authentication bypass vulnerability in phpMyFAQ where attackers can replay captured authentication data to gain unauthorized acc...

This CVE describes an improper privilege management vulnerability in phpMyFAQ versions prior to 3.1.12. It allows authenticated users to escalate priv...

CVE-2023-0880 is an input misinterpretation vulnerability in phpMyFAQ that allows attackers to manipulate input processing, potentially leading to una...

This CVE describes a cross-site scripting (XSS) vulnerability in phpMyFAQ software versions prior to 3.1.11. Attackers can inject malicious scripts in...

CVE-2023-0788 is a code injection vulnerability in phpMyFAQ that allows attackers to execute arbitrary code on affected systems. This affects all user...

CVE-2023-0790 is an uncaught exception vulnerability in phpMyFAQ that can lead to denial of service or information disclosure. Attackers can trigger u...

This CVE describes weak password requirements in phpMyFAQ versions prior to 3.1.11, allowing attackers to more easily guess or brute-force user passwo...

This CVE describes a reflected cross-site scripting (XSS) vulnerability in phpMyFAQ versions prior to 3.1.9. Attackers can inject malicious scripts vi...