Product
An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.