{"schema_version":1,"title":"Phpmyfaq vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 21 vulnerabilities in Phpmyfaq: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111905, was published on 17 October 2026. 4 vulnerabilities in the last four weeks, up 33% on the four before (3). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/phpmyfaq","json_url":"https://junglewise.ai/threats/vendors/phpmyfaq.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/phpmyfaq","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":10,"all_time":21,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":11,"last_365_days":21},"latest":[{"cve":"CVE-2026-111905","cvss":6,"slug":"cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta","title":"phpMyFAQ insecure direct object reference in admin user API","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:32.563+00:00","url":"https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta"},{"cve":"CVE-2026-111901","cvss":7.5,"slug":"cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled","title":"phpMyFAQ uncontrolled resource consumption in API pagination","severity":"high","exploited":false,"published_at":"2026-10-17T19:16:31.953+00:00","url":"https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled"},{"cve":"CVE-2026-111900","cvss":4.3,"slug":"cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains","title":"phpMyFAQ improper authorization in attachment.php","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.8+00:00","url":"https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains"},{"cve":"CVE-2026-111895","cvss":6.8,"slug":"cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains","title":"phpMyFAQ authentication bypass in Microsoft Entra ID login","severity":"medium","exploited":false,"published_at":"2026-10-17T19:16:31.177+00:00","url":"https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains"},{"cve":"CVE-2026-56738","cvss":4,"epss":0.0026,"slug":"cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add","title":"phpMyFAQ SQL injection in StopWords::add()","severity":"high","exploited":false,"published_at":"2026-09-24T17:17:04.89+00:00","url":"https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add"},{"cve":"CVE-2026-56737","cvss":8.1,"epss":0.004,"slug":"cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass","title":"phpMyFAQ two-factor authentication password bypass","severity":"high","exploited":false,"published_at":"2026-09-24T16:17:07.637+00:00","url":"https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass"},{"cve":"CVE-2026-56736","cvss":8.2,"epss":0.0024,"slug":"cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass","title":"phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass","severity":"high","exploited":false,"published_at":"2026-09-24T15:17:24.1+00:00","url":"https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass"},{"cve":"CVE-2026-85591","cvss":7.1,"epss":0.0052,"slug":"cve-2026-85591-phpmyfaq-unverified-password-change-in-user-control-panel-api","title":"phpMyFAQ unverified password change in user control panel API","severity":"info","exploited":false,"published_at":"2026-09-04T12:17:22.433+00:00","url":"https://junglewise.ai/threats/cve-2026-85591-phpmyfaq-unverified-password-change-in-user-control-panel-api"},{"cve":"CVE-2026-85587","cvss":5.3,"epss":0.0036,"slug":"cve-2026-85587-phpmyfaq-incorrect-permission-checks-on-admin-content-pages","title":"phpMyFAQ incorrect permission checks on admin content pages","severity":"info","exploited":false,"published_at":"2026-09-04T12:17:20.867+00:00","url":"https://junglewise.ai/threats/cve-2026-85587-phpmyfaq-incorrect-permission-checks-on-admin-content-pages"},{"cve":"CVE-2026-85586","cvss":6.9,"epss":0.0049,"slug":"cve-2026-85586-phpmyfaq-captcha-bypass-in-question-submission-via-store","title":"phpMyFAQ CAPTCHA bypass in question submission via store parameter","severity":"info","exploited":false,"published_at":"2026-09-04T12:17:20.737+00:00","url":"https://junglewise.ai/threats/cve-2026-85586-phpmyfaq-captcha-bypass-in-question-submission-via-store"},{"cve":"CVE-2026-76208","cvss":8.2,"epss":0.0044,"slug":"cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication","title":"phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…","severity":"high","exploited":false,"published_at":"2026-08-19T14:17:46.22+00:00","url":"https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication"},{"cve":"CVE-2026-57996","cvss":8.8,"slug":"cve-2026-57996-phpmyfaq-privilege-escalation-in-user-add-api-endpoint","title":"phpMyFAQ privilege escalation in user/add API endpoint","severity":"high","exploited":false,"published_at":"2026-07-15T12:18:16.143+00:00","url":"https://junglewise.ai/threats/cve-2026-57996-phpmyfaq-privilege-escalation-in-user-add-api-endpoint"},{"cve":"CVE-2026-57994","cvss":5.3,"epss":0.0036,"slug":"cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public","title":"phpMyFAQ information disclosure of inactive FAQ content in public API","severity":"medium","exploited":false,"published_at":"2026-07-10T15:16:47.85+00:00","url":"https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public"},{"cve":"CVE-2026-57961","cvss":3.1,"epss":0.004,"slug":"cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function","title":"phpMyFAQ path traversal in PDF export concatenatePaths function","severity":"low","exploited":false,"published_at":"2026-07-10T15:16:47.057+00:00","url":"https://junglewise.ai/threats/cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function"},{"cve":"CVE-2026-57995","cvss":8.8,"epss":0.0044,"slug":"cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller","title":"phpMyFAQ privilege escalation in GroupController updatePermissions","severity":"high","exploited":false,"published_at":"2026-06-30T23:17:32.537+00:00","url":"https://junglewise.ai/threats/cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller"},{"cve":"CVE-2026-56396","cvss":8.8,"epss":0.0044,"slug":"cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights","title":"phpMyFAQ privilege escalation in editUser and updateUserRights","severity":"high","exploited":false,"published_at":"2026-06-21T14:16:26.66+00:00","url":"https://junglewise.ai/threats/cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights"},{"cve":"CVE-2026-46365","cvss":5.4,"epss":0.003,"slug":"cve-2026-46365-phpmyfaq-missing-authorization-in-tag-deletion-api","title":"phpMyFAQ missing authorization in tag deletion API","severity":"medium","exploited":false,"published_at":"2026-05-15T19:17:03.86+00:00","url":"https://junglewise.ai/threats/cve-2026-46365-phpmyfaq-missing-authorization-in-tag-deletion-api"},{"cve":"CVE-2026-34729","cvss":6.1,"epss":0.0024,"slug":"cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes","title":"phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:42.393+00:00","url":"https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes"},{"cve":"CVE-2026-34728","cvss":8.7,"epss":0.0069,"slug":"cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in","title":"phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController","severity":"high","exploited":false,"published_at":"2026-04-02T15:16:41.77+00:00","url":"https://junglewise.ai/threats/cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in"},{"cve":"CVE-2026-32629","cvss":6.1,"epss":0.0026,"slug":"cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field","title":"phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor","severity":"medium","exploited":false,"published_at":"2026-04-02T15:16:38.017+00:00","url":"https://junglewise.ai/threats/cve-2026-32629-phpmyfaq-is-vulnerable-to-stored-xss-via-unsanitized-email-field"},{"cve":"CVE-2025-62519","cvss":7.2,"epss":0.0074,"slug":"cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update","title":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","severity":"high","exploited":false,"published_at":"2025-11-17T17:15:50.4+00:00","url":"https://junglewise.ai/threats/cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update"}],"vendor":{"hub":true,"name":"Phpmyfaq","slug":"phpmyfaq","description":"Open-source frequently asked questions management system.","url":"https://junglewise.ai/threats/vendors/phpmyfaq"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-57995","cvss":8.8,"epss":0.0044,"slug":"cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller","title":"phpMyFAQ privilege escalation in GroupController updatePermissions","severity":"high","exploited":false,"published_at":"2026-06-30T23:17:32.537+00:00","url":"https://junglewise.ai/threats/cve-2026-57995-phpmyfaq-privilege-escalation-in-groupcontroller"},{"cve":"CVE-2026-56396","cvss":8.8,"epss":0.0044,"slug":"cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights","title":"phpMyFAQ privilege escalation in editUser and updateUserRights","severity":"high","exploited":false,"published_at":"2026-06-21T14:16:26.66+00:00","url":"https://junglewise.ai/threats/cve-2026-56396-phpmyfaq-privilege-escalation-in-edituser-and-updateuserrights"},{"cve":"CVE-2026-57996","cvss":8.8,"slug":"cve-2026-57996-phpmyfaq-privilege-escalation-in-user-add-api-endpoint","title":"phpMyFAQ privilege escalation in user/add API endpoint","severity":"high","exploited":false,"published_at":"2026-07-15T12:18:16.143+00:00","url":"https://junglewise.ai/threats/cve-2026-57996-phpmyfaq-privilege-escalation-in-user-add-api-endpoint"},{"cve":"CVE-2026-34728","cvss":8.7,"epss":0.0069,"slug":"cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in","title":"phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController","severity":"high","exploited":false,"published_at":"2026-04-02T15:16:41.77+00:00","url":"https://junglewise.ai/threats/cve-2026-34728-phpmyfaq-path-traversal-arbitrary-file-deletion-in"},{"cve":"CVE-2026-76208","cvss":8.2,"epss":0.0044,"slug":"cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication","title":"phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…","severity":"high","exploited":false,"published_at":"2026-08-19T14:17:46.22+00:00","url":"https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication"},{"cve":"CVE-2026-56736","cvss":8.2,"epss":0.0024,"slug":"cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass","title":"phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass","severity":"high","exploited":false,"published_at":"2026-09-24T15:17:24.1+00:00","url":"https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass"},{"cve":"CVE-2026-56737","cvss":8.1,"epss":0.004,"slug":"cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass","title":"phpMyFAQ two-factor authentication password bypass","severity":"high","exploited":false,"published_at":"2026-09-24T16:17:07.637+00:00","url":"https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass"},{"cve":"CVE-2026-111901","cvss":7.5,"slug":"cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled","title":"phpMyFAQ uncontrolled resource consumption in API pagination","severity":"high","exploited":false,"published_at":"2026-10-17T19:16:31.953+00:00","url":"https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled"},{"cve":"CVE-2025-62519","cvss":7.2,"epss":0.0074,"slug":"cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update","title":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","severity":"high","exploited":false,"published_at":"2025-11-17T17:15:50.4+00:00","url":"https://junglewise.ai/threats/cve-2025-62519-phpmyfaq-has-authenticated-sql-injection-in-configuration-update"},{"cve":"CVE-2026-56738","cvss":4,"epss":0.0026,"slug":"cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add","title":"phpMyFAQ SQL injection in StopWords::add()","severity":"high","exploited":false,"published_at":"2026-09-24T17:17:04.89+00:00","url":"https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Phpmyfaq","slug":"phpmyfaq-phpmyfaq-1","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1"}]}