Search for packages
| purl | pkg:composer/thorsten/phpmyfaq@3.1.16 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1kny-sn17-gbdz
Aliases: CVE-2023-5320 GHSA-pp4w-g5p4-85p2 |
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
Affected by 27 other vulnerabilities. |
|
VCID-1q6p-7t7t-87e5
Aliases: CVE-2023-5317 GHSA-5jwv-m8h3-69cg |
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
Affected by 27 other vulnerabilities. |
|
VCID-1qwx-htn1-4bg8
Aliases: CVE-2026-46364 GHSA-289f-fq7w-6q2w |
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database. |
Affected by 1 other vulnerability. |
|
VCID-2bb7-xtyn-dbcq
Aliases: CVE-2023-5864 GHSA-g5hp-328h-jj98 |
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
Affected by 26 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-2bsv-7dt5-6qcu
Aliases: CVE-2024-55889 GHSA-m3r7-8gw7-qwvc |
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue. |
Affected by 22 other vulnerabilities. |
|
VCID-2wd2-u5mg-suh4
Aliases: CVE-2023-5867 GHSA-prrv-r843-4p75 |
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
Affected by 22 other vulnerabilities. |
|
VCID-57ev-2w6v-mbbs
Aliases: CVE-2026-24421 GHSA-wm8h-26fv-mg7g |
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17. |
Affected by 0 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-5pw3-qxh6-6ufr
Aliases: CVE-2026-46366 GHSA-99qv-g4x9-mgc3 |
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links. |
Affected by 1 other vulnerability. |
|
VCID-5wsg-7979-dqgs
Aliases: CVE-2025-62519 GHSA-fxm2-cmwj-qvx4 |
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14. |
Affected by 20 other vulnerabilities. |
|
VCID-6jmj-n5mz-bba8
Aliases: CVE-2026-24420 GHSA-7p9h-m7m8-vhhv |
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version |
Affected by 0 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-6w5z-nvj8-wke8
Aliases: CVE-2023-5865 GHSA-f728-prhw-2g68 |
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
Affected by 22 other vulnerabilities. |
|
VCID-7tpb-1avq-zfhu
Aliases: CVE-2026-46361 GHSA-pqh6-8fxf-jx22 |
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators. |
Affected by 1 other vulnerability. |
|
VCID-8k51-budg-h3ak
Aliases: CVE-2026-45007 GHSA-rm98-82fr-mcfx |
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control. |
Affected by 1 other vulnerability. |
|
VCID-9mx6-54u5-fugf
Aliases: CVE-2026-34974 GHSA-5crx-pfhq-4hgg |
Affected by 13 other vulnerabilities. |
|
|
VCID-b64e-gffa-5kg7
Aliases: CVE-2024-54141 GHSA-vrjr-p3xp-xx2x |
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0. |
Affected by 21 other vulnerabilities. |
|
VCID-e4ep-gxfy-jbah
Aliases: CVE-2023-5866 GHSA-34w4-wrqp-j47g |
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
Affected by 26 other vulnerabilities. |
|
VCID-ecpv-3xqn-eqf8
Aliases: CVE-2026-46360 GHSA-whqh-9pq5-c7r3 |
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG. |
Affected by 1 other vulnerability. |
|
VCID-emzq-e5ru-w3cx
Aliases: CVE-2026-27836 GHSA-w22q-m2fm-x9f4 |
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue. |
Affected by 14 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-kppj-ng9a-9fhs
Aliases: CVE-2023-6889 GHSA-w8xj-992g-842f |
Affected by 32 other vulnerabilities. |
|
|
VCID-p68j-sbvd-yuh4
Aliases: CVE-2026-24422 GHSA-j4rc-96xj-gvqc |
phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17. |
Affected by 0 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-q6zp-tnjb-pye3
Aliases: CVE-2026-34973 GHSA-gcp9-5jc8-976x |
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure. This issue has been patched in version 4.1.1. |
Affected by 13 other vulnerabilities. |
|
VCID-qhsm-g24v-k7gj
Aliases: CVE-2026-32629 GHSA-98gw-w575-h2ph |
Affected by 13 other vulnerabilities. |
|
|
VCID-rrz3-kbbd-eyhq
Aliases: CVE-2026-45010 GHSA-9pq7-mfwh-xx2j |
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access. |
Affected by 1 other vulnerability. |
|
VCID-tpbv-urbk-h7gf
Aliases: CVE-2026-46359 GHSA-pm8c-3qq3-72w7 |
phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries. |
Affected by 1 other vulnerability. |
|
VCID-txxg-bugj-6bd4
Aliases: CVE-2026-45008 GHSA-gh9p-q46p-57g2 |
phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope. |
Affected by 1 other vulnerability. |
|
VCID-u37t-naar-pbav
Aliases: CVE-2025-69200 GHSA-9cg9-4h4f-j6fg |
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue. |
Affected by 18 other vulnerabilities. |
|
VCID-uerm-mjrz-vyg4
Aliases: CVE-2023-5227 GHSA-qcjg-hvg6-hxcp |
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
Affected by 27 other vulnerabilities. |
|
VCID-ufhy-fdmw-hkdv
Aliases: CVE-2023-5319 GHSA-j5ww-5xf4-hqm2 |
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
Affected by 27 other vulnerabilities. |
|
VCID-vjqh-59nn-5ude
Aliases: CVE-2026-46363 GHSA-f5p7-2c9q-8896 |
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter. |
Affected by 1 other vulnerability. |
|
VCID-xt5z-y1n5-37fn
Aliases: CVE-2023-5863 GHSA-j4vj-w5rj-8grw |
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
Affected by 22 other vulnerabilities. |
|
VCID-yckn-74u4-pkaw
Aliases: GHSA-7cx3-2qx2-3g6w |
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags ## Summary The `TagController::delete()` endpoint at `DELETE /admin/api/content/tags/{tagId}` only verifies that the user is logged in (`userIsAuthenticated()`), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with `TagController::update()` and `TagController::search()`, which both enforce the `FAQ_EDIT` permission. ## Details In `phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php`, the `delete()` method (line 121-133) uses only `$this->userIsAuthenticated()`: ```php #[Route(path: 'content/tags/{tagId}', name: 'admin.api.content.tags.id', methods: ['DELETE'])] public function delete(Request $request): JsonResponse { $this->userIsAuthenticated(); // Only checks isLoggedIn() — no permission check $tagId = (int) Filter::filterVar($request->attributes->get('tagId'), FILTER_VALIDATE_INT); if ($this->tags->delete($tagId)) { return $this->json(['success' => Translation::get(key: 'ad_tag_delete_success')], Response::HTTP_OK); } return $this->json(['error' => Translation::get(key: 'ad_tag_delete_error')], Response::HTTP_BAD_REQUEST); } ``` Compare with `update()` (line 48-71) which properly enforces authorization: ```php public function update(Request $request): JsonResponse { $this->userHasPermission(PermissionType::FAQ_EDIT); // Proper permission check // ... also verifies CSRF token ... } ``` The `userIsAuthenticated()` method in `AbstractController` (line 258-263) only checks `$this->currentUser->isLoggedIn()`: ```php protected function userIsAuthenticated(): void { if (!$this->currentUser->isLoggedIn()) { throw new UnauthorizedHttpException(challenge: 'User is not authenticated.'); } } ``` There is no admin-level middleware in the `Kernel` — it registers only RouterListener, LanguageListener, ControllerContainerListener, and exception listeners. The admin API entry point (`admin/api/index.php`) shares the same bootstrap and session as the frontend, meaning a frontend user's session cookie is valid for admin API requests. Additionally, this endpoint lacks CSRF token verification (unlike `update()`), though the primary issue is the missing authorization since the attack vector is a logged-in user acting directly. ## PoC ```bash # Step 1: Register as a regular user on the phpMyFAQ frontend # (or use any existing non-admin authenticated session) # Step 2: As the authenticated non-admin user, delete tag with ID 1: curl -X DELETE 'https://target.com/admin/api/content/tags/1' \ -H 'Cookie: PHPSESSID=<regular_user_session>' # Expected: 401 or 403 (user lacks FAQ_EDIT permission) # Actual: 200 OK with {"success": "..."} # Step 3: Enumerate and delete all tags: for i in $(seq 1 100); do curl -s -X DELETE "https://target.com/admin/api/content/tags/$i" \ -H 'Cookie: PHPSESSID=<regular_user_session>' done ``` ## Impact Any authenticated user (including regular frontend users who registered through the public registration form) can delete all tags in the phpMyFAQ instance. This results in: - **Data integrity loss:** Tags are permanently deleted from the database. All FAQ-to-tag associations are destroyed. - **Disruption of FAQ organization:** Tag-based navigation, filtering, and tag clouds become empty or broken. - **No recoverability without backup:** Deleted tags and their associations cannot be restored without a database backup. The impact is limited to tags (not FAQ content itself), but in large installations with extensive tag taxonomies, this could significantly degrade usability. ## Recommended Fix Add the `FAQ_EDIT` permission check and CSRF token verification to `TagController::delete()`, consistent with `TagController::update()`: ```php #[Route(path: 'content/tags/{tagId}', name: 'admin.api.content.tags.id', methods: ['DELETE'])] public function delete(Request $request): JsonResponse { $this->userHasPermission(PermissionType::FAQ_EDIT); $tagId = (int) Filter::filterVar($request->attributes->get('tagId'), FILTER_VALIDATE_INT); if ($this->tags->delete($tagId)) { return $this->json(['success' => Translation::get(key: 'ad_tag_delete_success')], Response::HTTP_OK); } return $this->json(['error' => Translation::get(key: 'ad_tag_delete_error')], Response::HTTP_BAD_REQUEST); } ``` At minimum, add `$this->userHasPermission(PermissionType::FAQ_EDIT)` to enforce the same authorization as the update and search endpoints. Consider also adding a dedicated `TAG_DELETE` permission type for more granular access control. |
Affected by 1 other vulnerability. |
|
VCID-z4qa-mnne-pyay
Aliases: CVE-2023-6890 GHSA-4h37-q5j3-hw96 |
Affected by 32 other vulnerabilities. |
|
|
VCID-z8kb-6u51-8bd9
Aliases: CVE-2023-5316 GHSA-58v7-58c2-qwm9 |
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. |
Affected by 27 other vulnerabilities. |
|
VCID-zr1w-jzzj-a7gd
Aliases: CVE-2026-46362 GHSA-hpgw-ww76-c68r |
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-rp5d-6b4k-33g5 |
CVE-2023-4006
GHSA-2xvx-368h-qcmv |
|
| VCID-x1gz-3d4a-1qdy | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16. |
CVE-2023-4007
GHSA-q9vm-29ph-p7mp |