Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*

3 briefs RSS
high advisory

phpMyFAQ: Object-level authorization bypass (CVE-2026-116183)

An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.

phpMyFAQ
1t 1c
critical advisory

SQL Injection in phpMyFAQ via PdoMysql::escape()

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

phpMyFAQ +4 web-application sql-injection cve authentication-bypass sso cve-2026-111882 web-application-vulnerability authorization-bypass +2
6t 1c updated
high advisory

SQL Injection in phpMyFAQ StopWords::add()

An authenticated administrator can exploit an unescaped SQL insertion vulnerability in the phpMyFAQ StopWords::add() method (CVE-2026-56738) to execute arbitrary database commands.

phpMyFAQ +2 cve-2026-56737 authentication-bypass web-security
2r 3t 1c