{"schema_version":1,"title":"Phpmyfaq vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Phpmyfaq: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111905, was published on 17 October 2026. 4 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1","json_url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":4,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":5,"last_365_days":9},"latest":[{"cve":"CVE-2026-111905","cvss":6,"slug":"cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta","title":"phpMyFAQ insecure direct object reference in admin user API","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:32.563+00:00","url":"https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta"},{"cve":"CVE-2026-111901","cvss":7.5,"slug":"cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled","title":"phpMyFAQ uncontrolled resource consumption in API pagination","severity":"high","exploited":false,"published_at":"2026-10-17T19:16:31.953+00:00","url":"https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled"},{"cve":"CVE-2026-111900","cvss":4.3,"slug":"cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains","title":"phpMyFAQ improper authorization in attachment.php","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.8+00:00","url":"https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains"},{"cve":"CVE-2026-111895","cvss":6.8,"slug":"cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains","title":"phpMyFAQ authentication bypass in Microsoft Entra ID login","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.177+00:00","url":"https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains"},{"cve":"CVE-2026-76208","cvss":8.2,"epss":0.0044,"slug":"cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication","title":"phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…","severity":"high","exploited":false,"published_at":"2026-08-19T14:17:46.22+00:00","url":"https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication"},{"cve":"CVE-2026-34729","cvss":6.1,"epss":0.0024,"slug":"cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes","title":"phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:42.393+00:00","url":"https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes"},{"cve":"CVE-2026-34728","cvss":8.7,"epss":0.0069,"slug":"cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in","title":"phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController","severity":"high","exploited":false,"published_at":"2026-04-02T15:16:41.77+00:00","url":"https://junglewise.ai/threats/cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in"},{"cve":"CVE-2026-32629","cvss":6.1,"epss":0.0026,"slug":"cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field","title":"phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:38.017+00:00","url":"https://junglewise.ai/threats/cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field"},{"cve":"CVE-2025-62519","cvss":7.2,"epss":0.0074,"slug":"cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update","title":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","severity":"high","exploited":false,"published_at":"2025-11-17T17:15:50.4+00:00","url":"https://junglewise.ai/threats/cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Phpmyfaq","slug":"phpmyfaq-phpmyfaq-1","vendor":{"hub":true,"name":"Phpmyfaq","slug":"phpmyfaq","url":"https://junglewise.ai/threats/vendors/phpmyfaq"},"aliases":[],"category":"cms","description":"phpMyFAQ is an open-source FAQ management system and content management software.","url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1"},"most_severe":[{"cve":"CVE-2026-34728","cvss":8.7,"epss":0.0069,"slug":"cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in","title":"phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController","severity":"high","exploited":false,"published_at":"2026-04-02T15:16:41.77+00:00","url":"https://junglewise.ai/threats/cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in"},{"cve":"CVE-2026-76208","cvss":8.2,"epss":0.0044,"slug":"cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication","title":"phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…","severity":"high","exploited":false,"published_at":"2026-08-19T14:17:46.22+00:00","url":"https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication"},{"cve":"CVE-2026-111901","cvss":7.5,"slug":"cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled","title":"phpMyFAQ uncontrolled resource consumption in API pagination","severity":"high","exploited":false,"published_at":"2026-10-17T19:16:31.953+00:00","url":"https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled"},{"cve":"CVE-2025-62519","cvss":7.2,"epss":0.0074,"slug":"cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update","title":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","severity":"high","exploited":false,"published_at":"2025-11-17T17:15:50.4+00:00","url":"https://junglewise.ai/threats/cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update"},{"cve":"CVE-2026-111895","cvss":6.8,"slug":"cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains","title":"phpMyFAQ authentication bypass in Microsoft Entra ID login","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.177+00:00","url":"https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains"},{"cve":"CVE-2026-32629","cvss":6.1,"epss":0.0026,"slug":"cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field","title":"phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:38.017+00:00","url":"https://junglewise.ai/threats/cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field"},{"cve":"CVE-2026-34729","cvss":6.1,"epss":0.0024,"slug":"cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes","title":"phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:42.393+00:00","url":"https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes"},{"cve":"CVE-2026-111905","cvss":6,"slug":"cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta","title":"phpMyFAQ insecure direct object reference in admin user API","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:32.563+00:00","url":"https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta"},{"cve":"CVE-2026-111900","cvss":4.3,"slug":"cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains","title":"phpMyFAQ improper authorization in attachment.php","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.8+00:00","url":"https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}