# thorsten/phpmyfaq (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/thorsten-phpmyfaq Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/thorsten-phpmyfaq.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 119 vulnerabilities in thorsten/phpmyfaq (Packagist): 0 in the last 7 days and 4 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-56738, was published on 24 September 2026. Nothing in the last four weeks, down from 4 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 119 (4 critical, 0 exploited in the wild) ## About thorsten/phpmyfaq (Packagist) An open-source multilingual FAQ software package written in PHP. ## Latest thorsten/phpmyfaq (Packagist) vulnerabilities - [CVE-2026-56738: phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add) (high, CVSS 4, published 24 Sep 2026) - [CVE-2026-47132: phpMyFAQ SQL LIKE wildcard injection in chat user search](https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search) (medium, CVSS 5.4, published 24 Sep 2026) - [CVE-2026-56737: phpMyFAQ two-factor authentication password bypass](https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass) (high, CVSS 8.1, published 24 Sep 2026) - [CVE-2026-56736: phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass) (high, CVSS 8.2, published 24 Sep 2026) - [CVE-2026-57994: phpMyFAQ information disclosure of inactive FAQ content in public API](https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public) (medium, CVSS 5.3, published 10 Jul 2026) - [CVE-2026-57961: phpMyFAQ path traversal in PDF export concatenatePaths function](https://junglewise.ai/threats/cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function) (low, CVSS 3.1, published 10 Jul 2026) - [CVE-2026-57995: phpMyFAQ privilege escalation in GroupController updatePermissions](https://junglewise.ai/threats/cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2026-56396: phpMyFAQ privilege escalation in editUser and updateUserRights](https://junglewise.ai/threats/cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights) (high, CVSS 8.8, published 21 Jun 2026) - [CVE-2026-49205: phpMyFAQ missing authorization in API write endpoints](https://junglewise.ai/threats/cve-2026-49205-phpmyfaq-missing-authorization-in-api-write-endpoints) (medium, CVSS 6.5, published 18 Jun 2026) - [CVE-2026-48488: phpMyFAQ weak cryptographic hash for attachment passwords](https://junglewise.ai/threats/cve-2026-48488-phpmyfaq-weak-cryptographic-hash-for-attachment-passwords) (medium, CVSS 4, published 8 Jun 2026) - [CVE-2026-35676: phpMyFAQ unauthenticated password reset in user password update API](https://junglewise.ai/threats/cve-2026-35676-phpmyfaq-unauthenticated-password-reset-in-user-password-update) (high, CVSS 8.2, published 28 May 2026) - [CVE-2026-35675: phpMyFAQ authentication bypass in password reset API](https://junglewise.ai/threats/cve-2026-35675-phpmyfaq-authentication-bypass-in-password-reset-api) (high, CVSS 8.2, published 28 May 2026) - [CVE-2026-35672: phpMyFAQ authentication bypass in REST API v4.0](https://junglewise.ai/threats/cve-2026-35672-phpmyfaq-authentication-bypass-in-rest-api-v4-0) (high, CVSS 7.5, published 28 May 2026) - [CVE-2026-35671: phpMyFAQ IDOR in admin API user password endpoint](https://junglewise.ai/threats/cve-2026-35671-phpmyfaq-idor-in-admin-api-user-password-endpoint) (high, CVSS 8.8, published 28 May 2026) - [phpMyFAQ 2FA bypass via unauthenticated brute-force in admin check endpoint](https://junglewise.ai/threats/phpmyfaq-2fa-bypass-via-unauthenticated-brute-force-in-admin-check-7a3aa01c) (critical, CVSS 9.1, published 15 May 2026) - [phpMyFAQ authorization bypass in AbstractAdministrationController](https://junglewise.ai/threats/phpmyfaq-authorization-bypass-in-abstractadministrationcontroller-4d6c5440) (medium, CVSS 6.5, published 15 May 2026) - [phpMyFAQ missing authorization in Admin API configuration endpoints](https://junglewise.ai/threats/phpmyfaq-missing-authorization-in-admin-api-configuration-endpoints-89d3b47f) (medium, CVSS 4.3, published 15 May 2026) - [phpMyFAQ stored XSS in search result rendering](https://junglewise.ai/threats/phpmyfaq-stored-xss-in-search-result-rendering-9f7f3087) (medium, CVSS 6.9, published 15 May 2026) - [phpMyFAQ information disclosure via solution ID permission bypass](https://junglewise.ai/threats/phpmyfaq-information-disclosure-via-solution-id-permission-bypass-f1d9aedf) (high, CVSS 7.5, published 15 May 2026) - [phpMyFAQ SQL injection in CurrentUser::setTokenData](https://junglewise.ai/threats/phpmyfaq-sql-injection-in-currentuser-settokendata-3dcbb4d3) (high, CVSS 7.5, published 15 May 2026) - [phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header](https://junglewise.ai/threats/phpmyfaq-sql-injection-in-builtincaptcha-via-user-agent-header-23e44a8e) (critical, CVSS 9.8, published 15 May 2026) - [CVE-2026-46367: phpMyFAQ stored XSS in Utils::parseUrl via comments](https://junglewise.ai/threats/cve-2026-46367-phpmyfaq-stored-xss-in-utils-parseurl-via-comments) (high, CVSS 7.6, published 15 May 2026) - [CVE-2026-46366: phpMyFAQ information disclosure in getIdFromSolutionId](https://junglewise.ai/threats/cve-2026-46366-phpmyfaq-information-disclosure-in-getidfromsolutionid) (high, CVSS 7.5, published 15 May 2026) - [CVE-2026-46365: phpMyFAQ missing authorization in tag deletion API](https://junglewise.ai/threats/cve-2026-46365-phpmyfaq-missing-authorization-in-tag-deletion-api) (medium, CVSS 5.4, published 15 May 2026) - [CVE-2026-46364: phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header](https://junglewise.ai/threats/cve-2026-46364-phpmyfaq-sql-injection-in-builtincaptcha-via-user-agent-header) (critical, CVSS 9.8, published 15 May 2026) ## Most severe thorsten/phpmyfaq (Packagist) vulnerabilities - [CVE-2026-46364: phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header](https://junglewise.ai/threats/cve-2026-46364-phpmyfaq-sql-injection-in-builtincaptcha-via-user-agent-header) (critical, CVSS 9.8, published 15 May 2026) - [phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header](https://junglewise.ai/threats/phpmyfaq-sql-injection-in-builtincaptcha-via-user-agent-header-23e44a8e) (critical, CVSS 9.8, published 15 May 2026) - [CVE-2026-45010: thorsten phpMyFAQ 2FA bypass via brute-force in /admin/check](https://junglewise.ai/threats/cve-2026-45010-thorsten-phpmyfaq-2fa-bypass-via-brute-force-in-admin-check) (critical, CVSS 9.1, published 15 May 2026) - [phpMyFAQ 2FA bypass via unauthenticated brute-force in admin check endpoint](https://junglewise.ai/threats/phpmyfaq-2fa-bypass-via-unauthenticated-brute-force-in-admin-check-7a3aa01c) (critical, CVSS 9.1, published 15 May 2026) - [CVE-2026-57995: phpMyFAQ privilege escalation in GroupController updatePermissions](https://junglewise.ai/threats/cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller) (high, CVSS 8.8, published 30 Jun 2026) - [CVE-2026-56396: phpMyFAQ privilege escalation in editUser and updateUserRights](https://junglewise.ai/threats/cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights) (high, CVSS 8.8, published 21 Jun 2026) - [CVE-2026-35671: phpMyFAQ IDOR in admin API user password endpoint](https://junglewise.ai/threats/cve-2026-35671-phpmyfaq-idor-in-admin-api-user-password-endpoint) (high, CVSS 8.8, published 28 May 2026) - [CVE-2026-35675: phpMyFAQ authentication bypass in password reset API](https://junglewise.ai/threats/cve-2026-35675-phpmyfaq-authentication-bypass-in-password-reset-api) (high, CVSS 8.2, published 28 May 2026) - [CVE-2026-35676: phpMyFAQ unauthenticated password reset in user password update API](https://junglewise.ai/threats/cve-2026-35676-phpmyfaq-unauthenticated-password-reset-in-user-password-update) (high, CVSS 8.2, published 28 May 2026) - [CVE-2026-56736: phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass) (high, CVSS 8.2, published 24 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 4 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 4 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "thorsten/phpmyfaq (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/thorsten-phpmyfaq, 9 November 2026.