Advisories for packages from phpmyfaq

Listing reported advisories for packages from phpmyfaq sorted by their report date.

phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:46
phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:17:35
phpMyFAQ: Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:41
phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:16:26
phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 21:12:40
phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check
GitHub

phpMyFAQ/phpMyFAQ

< 4.1.2

2026-05-21 20:53:54
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:31:56
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:18:50
phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:18:05
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:12:09
phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check
GitHub

phpmyfaq/phpmyfaq

<= 4.1.1

2026-05-06 20:11:54
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
GitHub

phpmyfaq/phpmyfaq

<= 4.1.0

2026-04-01 22:31:44
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
GitHub

phpmyfaq/phpmyfaq

<= 4.1.0

2026-04-01 22:30:33
phpMyFAQ: Public API endpoints expose emails and invisible questions
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:36
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:26
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
GitHub

phpmyfaq/phpmyfaq

<= 4.0.16

2026-01-23 20:17:17
phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
GitHub

phpmyfaq/phpmyfaq

>= 3.2.10, <= 4.0.1

2025-01-02 22:43:41
phpMyFAQ stored Cross-site Scripting at user email
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:46:29
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:46:12
phpMyFAQ Stored Cross-site Scripting at FAQ News Content
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:45:54
phpMyFAQ SQL injections at insertentry & saveentry
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:45:39
phpMyFAQ Stored HTML Injection at contentLink
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:45:24
phpMyFAQ Stored Cross-site Scripting at File Attachments
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:45:14
phpMyFAQ SQL Injection at "Save News"
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:44:05
phpMyFAQ Path Traversal in Attachments
GitHub

phpmyfaq/phpmyfaq

= 3.2.5

2024-03-25 19:35:11
phpMyFAQ vulnerable to stored XSS on attachments filename
GitHub

phpmyfaq/phpmyfaq

< 3.2.5

2024-02-05 20:22:07
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
GitHub

phpmyfaq/phpmyfaq

< 3.2.5

2024-02-05 20:21:27
phpMyFAQ User Removal Page Allows Spoofing Of User Details
GitHub

phpmyfaq/phpmyfaq

< 3.2.5

2024-02-05 20:20:43