# thorsten phpMyFAQ.

Every CVE that names thorsten phpMyFAQ among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID](https://agentprime.io/advisories/CVE-2026-116183.md)
  `CVE-2026-116183` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching](https://agentprime.io/advisories/CVE-2026-116182.md)
  `CVE-2026-116182` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection](https://agentprime.io/advisories/CVE-2026-111911.md)
  `CVE-2026-111911` · CVE record: thorsten phpMyFAQ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads](https://agentprime.io/advisories/CVE-2026-111910.md)
  `CVE-2026-111910` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API](https://agentprime.io/advisories/CVE-2026-111909.md)
  `CVE-2026-111909` · CVE record: thorsten phpMyFAQ · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Privilege escalation
- [phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API](https://agentprime.io/advisories/CVE-2026-111908.md)
  `CVE-2026-111908` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database](https://agentprime.io/advisories/CVE-2026-111907.md)
  `CVE-2026-111907` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations](https://agentprime.io/advisories/CVE-2026-111906.md)
  `CVE-2026-111906` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data](https://agentprime.io/advisories/CVE-2026-111905.md)
  `CVE-2026-111905` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API](https://agentprime.io/advisories/CVE-2026-111904.md)
  `CVE-2026-111904` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Information disclosure
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass](https://agentprime.io/advisories/CVE-2026-111903.md)
  `CVE-2026-111903` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS)
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API](https://agentprime.io/advisories/CVE-2026-111902.md)
  `CVE-2026-111902` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination](https://agentprime.io/advisories/CVE-2026-111901.md)
  `CVE-2026-111901` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Denial of service
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php](https://agentprime.io/advisories/CVE-2026-111900.md)
  `CVE-2026-111900` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking](https://agentprime.io/advisories/CVE-2026-111898.md)
  `CVE-2026-111898` · CVE record: thorsten phpMyFAQ · CVSS 7.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints](https://agentprime.io/advisories/CVE-2026-111897.md)
  `CVE-2026-111897` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass](https://agentprime.io/advisories/CVE-2026-111896.md)
  `CVE-2026-111896` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-182
- [phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username](https://agentprime.io/advisories/CVE-2026-111895.md)
  `CVE-2026-111895` · CVE record: thorsten phpMyFAQ · CVSS 7.6 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI](https://agentprime.io/advisories/CVE-2026-111894.md)
  `CVE-2026-111894` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS)
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API](https://agentprime.io/advisories/CVE-2026-111893.md)
  `CVE-2026-111893` · CVE record: thorsten phpMyFAQ · CVSS 8.5 High · Not analysed yet · Published 17 Oct 2026 · Tags: Privilege escalation
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints](https://agentprime.io/advisories/CVE-2026-111892.md)
  `CVE-2026-111892` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API](https://agentprime.io/advisories/CVE-2026-111891.md)
  `CVE-2026-111891` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: Privilege escalation
- [phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights](https://agentprime.io/advisories/CVE-2026-111890.md)
  `CVE-2026-111890` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: Privilege escalation
- [phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard](https://agentprime.io/advisories/CVE-2026-111889.md)
  `CVE-2026-111889` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API](https://agentprime.io/advisories/CVE-2026-111888.md)
  `CVE-2026-111888` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint](https://agentprime.io/advisories/CVE-2026-111887.md)
  `CVE-2026-111887` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-204
- [phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint](https://agentprime.io/advisories/CVE-2026-111886.md)
  `CVE-2026-111886` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API](https://agentprime.io/advisories/CVE-2026-111885.md)
  `CVE-2026-111885` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-1220
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover](https://agentprime.io/advisories/CVE-2026-111884.md)
  `CVE-2026-111884` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-308
- [phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks](https://agentprime.io/advisories/CVE-2026-111882.md)
  `CVE-2026-111882` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint](https://agentprime.io/advisories/CVE-2026-109573.md)
  `CVE-2026-109573` · CVE record: thorsten phpMyFAQ · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: SQL injection
- [phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool](https://agentprime.io/advisories/CVE-2026-108851.md)
  `CVE-2026-108851` · CVE record: thorsten phpMyFAQ · CVSS 4.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode](https://agentprime.io/advisories/CVE-2026-85593.md)
  `CVE-2026-85593` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS)
- [phpMyFAQ before 4.1.8 Authorization Bypass via question/create](https://agentprime.io/advisories/CVE-2026-85592.md)
  `CVE-2026-85592` · CVE record: thorsten phpMyFAQ · CVSS 6.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change](https://agentprime.io/advisories/CVE-2026-85591.md)
  `CVE-2026-85591` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-620
- [phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable](https://agentprime.io/advisories/CVE-2026-85590.md)
  `CVE-2026-85590` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-308
- [phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API](https://agentprime.io/advisories/CVE-2026-85589.md)
  `CVE-2026-85589` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export](https://agentprime.io/advisories/CVE-2026-85588.md)
  `CVE-2026-85588` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure
- [phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages](https://agentprime.io/advisories/CVE-2026-85587.md)
  `CVE-2026-85587` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter](https://agentprime.io/advisories/CVE-2026-85586.md)
  `CVE-2026-85586` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-799
- [phpMyFAQ before 4.1.7 Missing Authorization via child resources](https://agentprime.io/advisories/CVE-2026-76215.md)
  `CVE-2026-76215` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge](https://agentprime.io/advisories/CVE-2026-76214.md)
  `CVE-2026-76214` · CVE record: thorsten phpMyFAQ · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle](https://agentprime.io/advisories/CVE-2026-76213.md)
  `CVE-2026-76213` · CVE record: thorsten phpMyFAQ · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL](https://agentprime.io/advisories/CVE-2026-76212.md)
  `CVE-2026-76212` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Command injection
- [phpMyFAQ before 4.1.7 Information Disclosure via Admin API](https://agentprime.io/advisories/CVE-2026-76211.md)
  `CVE-2026-76211` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export](https://agentprime.io/advisories/CVE-2026-76210.md)
  `CVE-2026-76210` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [phpMyFAQ before v4.1.6 Registration Bypass via API](https://agentprime.io/advisories/CVE-2026-76209.md)
  `CVE-2026-76209` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control
- [phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP](https://agentprime.io/advisories/CVE-2026-76208.md)
  `CVE-2026-76208` · CVE record: thorsten phpMyFAQ · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-778
- [phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie](https://agentprime.io/advisories/CVE-2026-76207.md)
  `CVE-2026-76207` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.7 Information Disclosure via PDF Export](https://agentprime.io/advisories/CVE-2026-76206.md)
  `CVE-2026-76206` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Information disclosure
- [phpMyFAQ before 4.1.7 SQL Injection via Glossary](https://agentprime.io/advisories/CVE-2026-76205.md)
  `CVE-2026-76205` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 19 Aug 2026 · Tags: SQL injection
- [phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP](https://agentprime.io/advisories/CVE-2026-75920.md)
  `CVE-2026-75920` · CVE record: thorsten phpMyFAQ · CVSS 6.0 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-377
- [phpMyFAQ before 4.1.7 Authentication Bypass via Setup API](https://agentprime.io/advisories/CVE-2026-75919.md)
  `CVE-2026-75919` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Authentication bypass
- [phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File](https://agentprime.io/advisories/CVE-2026-75918.md)
  `CVE-2026-75918` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: Information disclosure
- [phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership](https://agentprime.io/advisories/CVE-2026-66399.md)
  `CVE-2026-66399` · CVE record: thorsten phpMyFAQ · CVSS 8.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API](https://agentprime.io/advisories/CVE-2026-66398.md)
  `CVE-2026-66398` · CVE record: thorsten phpMyFAQ · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-494
- [phpMyFAQ before 4.1.6 Path Traversal via category image deletion](https://agentprime.io/advisories/CVE-2026-66397.md)
  `CVE-2026-66397` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=thorsten-phpmyfaq>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/thorsten-phpmyfaq/>. Everything for agents: <https://agentprime.io/llms.txt>.