[ Vendor · 34 CVEs ]
thorsten
CVEs affecting thorsten published in the last 30 days, plus any thorsten CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111908 | 17 Oct 2026 | CVSS 8.3 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT… | |
| CVE-2026-111909 | 17 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with… | |
| CVE-2026-111910 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to… | |
| CVE-2026-111911 | 17 Oct 2026 | CVSS 9.8 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account… | |
| CVE-2026-111902 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ… | |
| CVE-2026-111903 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT… | |
| CVE-2026-111904 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open… | |
| CVE-2026-111905 | 17 Oct 2026 | CVSS 6.0 | thorsten phpMyFAQphpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET… | |
| CVE-2026-111906 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch… | |
| CVE-2026-111907 | 17 Oct 2026 | CVSS 7.1 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes… | |
| CVE-2026-111894 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content… | |
| CVE-2026-111895 | 17 Oct 2026 | CVSS 6.8 | thorsten phpMyFAQphpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by… | |
| CVE-2026-111896 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store… | |
| CVE-2026-111897 | 17 Oct 2026 | CVSS 7.1 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments… | |
| CVE-2026-111898 | 17 Oct 2026 | CVSS 7.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by… | |
| CVE-2026-111900 | 17 Oct 2026 | CVSS 4.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify… | |
| CVE-2026-111901 | 17 Oct 2026 | CVSS 7.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API… | |
| CVE-2026-111888 | 17 Oct 2026 | CVSS 2.7 | thorsten phpMyFAQphpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify… | |
| CVE-2026-111889 | 17 Oct 2026 | CVSS 4.3 | thorsten phpMyFAQphpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows… | |
| CVE-2026-111890 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right… | |
| CVE-2026-111891 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and… | |
| CVE-2026-111892 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints… | |
| CVE-2026-111893 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets… | |
| CVE-2026-111882 | 17 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated… | |
| CVE-2026-111884 | 17 Oct 2026 | CVSS 8.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control… | |
| CVE-2026-111885 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits… | |
| CVE-2026-111886 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated… | |
| CVE-2026-111887 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to… | |
| CVE-2026-109573 | 12 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated… | |
| CVE-2026-108851 | 11 Oct 2026 | CVSS 3.3 | thorsten phpMyFAQphpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted… | |
| CVE-2026-47132 | 24 Sep 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in… | |
| CVE-2026-56738 | 24 Sep 2026 | CVSS 8.5 | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionphpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using… | Fix |
| CVE-2026-56737 | 24 Sep 2026 | CVSS 8.1 | phpMyFAQ's two-factor authentication login bypasses the password factorphpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication… | Fix |
| CVE-2026-56736 | 24 Sep 2026 | CVSS 8.2 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionphpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any… | Fix |