thorsten/phpmyfaq Known Vulnerabilities & Fixes
thorsten/phpmyfaq has 15 known security vulnerabilities in Packagist (PHP). Upgrade to version 4.2.0-alpha or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 4.2.0-alpha
Upgrading to 4.2.0-alpha or later resolves all 15 known vulnerabilities in thorsten/phpmyfaq. Run: composer require thorsten/phpmyfaq:^4.2.0-alpha
Is thorsten/phpmyfaq in your project?
Check if you're affected and upgrade to 4.2.0-alpha to stay secure.
Security Summary
- 15 affected version ranges have been identified across these 15 advisories.
- 93% of known issues have a published fixed version.
- Remediation: composer update thorsten/phpmyfaq
Vulnerabilities
15 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Oct 29, 2022, most recently Sep 24, 2026 (1426 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-46364 phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+166 more) | 4.1.2 |
| CVE-2026-45010 phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+166 more) | 4.1.2 |
| CVE-2023-0789 Command Injection in thorsten/phpmyfaq | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+98 more) | 3.1.11 |
| CVE-2023-0788 Code Injection in thorsten/phpmyfaq | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+98 more) | 3.1.11 |
| CVE-2023-0311 phpMyFAQ Improper Authentication vulnerability | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+97 more) | 3.1.10 |
| CVE-2022-3754 phpMyFAQ contains Weak Password Requirements | CRITICAL | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+95 more) | 3.1.8 |
| CVE-2026-57995 phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+169 more) | 4.1.5 |
| CVE-2026-35671 phpMyFAQ: IDOR Account Takeover | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+167 more) | 4.1.3 |
| CVE-2026-56736 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+173 more) | 4.2.0-alpha |
| CVE-2026-56737 phpMyFAQ's two-factor authentication login bypasses the password factor | HIGH | 3.2.0, 3.2.1, 3.2.10, 3.2.2 (+54 more) | 4.1.6 |
| CVE-2026-35675 phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+167 more) | 4.1.3 |
| CVE-2026-35676 phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+167 more) | 4.1.3 |
| CVE-2026-56396 phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards | HIGH | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+168 more) | 4.1.4 |
| CVE-2026-32629 phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor | MEDIUM | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+165 more) | 4.1.1 |
| CVE-2023-53929 phpMyFAQ contains a CSV injection vulnerability | MEDIUM | 2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2 (+100 more) | No fix available |
About This Data
Vulnerability data for thorsten/phpmyfaq is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Packagist (PHP) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of thorsten/phpmyfaq.