Phpmyfaq

This hub aggregates every CVE we track for Phpmyfaq, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Phpmyfaq.

• CVE-2026-66399phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership6.5Jul 27, 2026
• CVE-2026-57996phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint8.8Jul 15, 2026
• CVE-2026-57994phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints5.3Jul 10, 2026
• CVE-2026-57961phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function2.7Jul 10, 2026
• CVE-2026-57995phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions8.8Jun 30, 2026
• CVE-2026-56396phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()8.8Jun 21, 2026
• CVE-2026-49205phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)6.5Jun 18, 2026
• CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint8.2May 28, 2026
• CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update8.2May 28, 2026
• CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API Token7.5May 28, 2026
• CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password API8.8May 28, 2026
• CVE-2026-46367phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering7.6May 15, 2026
• CVE-2026-46366phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass7.5May 15, 2026
• CVE-2026-46365phpMyFAQ - Missing Authorization in Tag Deletion Endpoint5.4May 15, 2026
• CVE-2026-46363phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass5.4May 15, 2026