phpMyFAQ records

155 published records for vendor phpmyfaq.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 1 · 0.6%
Pre-auth RCE: 7
With a fix record: 71%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

155 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
42Plan	CVE-2011-4825Weaponized	Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phptinymce · tinymce · CWE-94 pre-auth RCE	High7.5	—	39.2%	Dec 14, 2011
39Monitor	CVE-2023-0789No exploit	Command Injection in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-77 pre-auth RCE Command injection	Critical9.8	—	1.7%	Feb 12, 2023
39Monitor	CVE-2022-3754No exploit	Weak Password Requirements in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-521 Pre-auth	Critical9.8	—	1.2%	Oct 29, 2022
39Monitor	CVE-2017-11187No exploit	phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.phpmyfaq · phpmyfaq · CWE-307 Pre-auth	Critical9.8	—	1.0%	Jul 12, 2017
39Monitor	CVE-2023-0311No exploit	Improper Authentication in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.9%	Jan 15, 2023
39Monitor	CVE-2023-0788No exploit	Code Injection in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-94 pre-auth RCE	Critical9.8	—	0.9%	Feb 12, 2023
39Monitor	CVE-2023-1886No exploit	Authentication Bypass by Capture-replay in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-294 Pre-auth Auth bypass	Critical9.8	—	0.9%	Apr 5, 2023
39Monitor	CVE-2023-4006No exploit	Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-1236 Pre-auth	Critical9.8	—	0.8%	Jul 30, 2023
39Monitor	CVE-2023-1753No exploit	Weak Password Requirements in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-521 Pre-auth	Critical9.8	—	0.7%	Mar 30, 2023
39Monitor	CVE-2023-0307No exploit	Weak Password Requirements in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-521 Pre-auth	Critical9.8	—	0.6%	Jan 15, 2023
39Monitor	CVE-2023-5865No exploit	Insufficient Session Expiration in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-613 Pre-auth	Critical9.8	—	0.6%	Oct 30, 2023
39Monitor	CVE-2023-2429No exploit	Improper Access Control in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Apr 29, 2023
39Monitor	CVE-2023-5227No exploit	Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-434 Pre-auth File upload	Critical9.8	—	0.5%	Sep 29, 2023
39Monitor	CVE-2025-59943No exploit	phpMyFAQ duplicate email registration allows multiple accounts with the same emailphpmyfaq · phpmyfaq · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.4%	Oct 3, 2025
36Monitor	CVE-2017-15730Proof of concept	In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.phpmyfaq · phpmyfaq · CWE-352 Pre-auth CSRF	High8.8	—	2.5%	Oct 22, 2017
36Monitor	CVE-2014-6046Proof of concept	Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of phpmyfaq · phpmyfaq · CWE-352 Pre-auth CSRF	High8.8	—	1.9%	Aug 28, 2018
36Monitor	CVE-2026-76213No exploit	phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttlephpmyfaq · phpmyfaq · CWE-307 Pre-auth	Critical9.1	—	0.4%	Aug 19, 2026
36Monitor	CVE-2026-76214No exploit	phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challengephpmyfaq · phpmyfaq · CWE-294 Pre-auth Auth bypass	Critical9.1	—	0.4%	Aug 19, 2026
35Monitor	CVE-2017-15808Proof of concept	In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.phpmyfaq · phpmyfaq · CWE-352 Pre-auth CSRF	High8.8	—	1.2%	Oct 23, 2017
35Monitor	CVE-2024-27299No exploit	phpMyFAQ SQL Injection at "Save News"phpmyfaq · phpmyfaq · CWE-89 RCE SQL injection	High8.8	—	1.2%	Mar 25, 2024
35Monitor	CVE-2017-15734Proof of concept	In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.phpmyfaq · phpmyfaq · CWE-352 Pre-auth CSRF	High8.8	—	1.1%	Oct 22, 2017
35Monitor	CVE-2017-15735Proof of concept	In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.phpmyfaq · phpmyfaq · CWE-352 Pre-auth CSRF	High8.8	—	1.1%	Oct 22, 2017
35Monitor	CVE-2024-28107No exploit	phpMyFAQ SQL injections at insertentry & saveentryphpmyfaq · phpmyfaq · CWE-89 RCE SQL injection	High8.8	—	1.0%	Mar 25, 2024
35Monitor	CVE-2023-1762No exploit	Improper Privilege Management in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-269	High8.8	—	0.9%	Mar 30, 2023
35Monitor	CVE-2023-0790No exploit	Uncaught Exception in thorsten/phpmyfaqphpmyfaq · phpmyfaq · CWE-248	High8.8	—	0.7%	Feb 12, 2023

CVE-2011-4825
42Plan
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, php
HighCVSS 7.5WeaponizedEPSS 39%
- pre-auth RCE
tinymce · tinymceDec 14, 2011
CVE-2023-0789
39Monitor
Command Injection in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Command injection
phpmyfaq · phpmyfaqFeb 12, 2023
CVE-2022-3754
39Monitor
Weak Password Requirements in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqOct 29, 2022
CVE-2017-11187
39Monitor
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqJul 12, 2017
CVE-2023-0311
39Monitor
Improper Authentication in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
phpmyfaq · phpmyfaqJan 15, 2023
CVE-2023-0788
39Monitor
Code Injection in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
phpmyfaq · phpmyfaqFeb 12, 2023
CVE-2023-1886
39Monitor
Authentication Bypass by Capture-replay in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
phpmyfaq · phpmyfaqApr 5, 2023
CVE-2023-4006
39Monitor
Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqJul 30, 2023
CVE-2023-1753
39Monitor
Weak Password Requirements in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqMar 30, 2023
CVE-2023-0307
39Monitor
Weak Password Requirements in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqJan 15, 2023
CVE-2023-5865
39Monitor
Insufficient Session Expiration in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
phpmyfaq · phpmyfaqOct 30, 2023
CVE-2023-2429
39Monitor
Improper Access Control in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
phpmyfaq · phpmyfaqApr 29, 2023
CVE-2023-5227
39Monitor
Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- File upload
phpmyfaq · phpmyfaqSep 29, 2023
CVE-2025-59943
39Monitor
phpMyFAQ duplicate email registration allows multiple accounts with the same email
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
phpmyfaq · phpmyfaqOct 3, 2025
CVE-2017-15730
36Monitor
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
HighCVSS 8.8Proof of conceptEPSS 2%
- Pre-auth
- CSRF
phpmyfaq · phpmyfaqOct 22, 2017
CVE-2014-6046
36Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of
HighCVSS 8.8Proof of conceptEPSS 2%
- Pre-auth
- CSRF
phpmyfaq · phpmyfaqAug 28, 2018
CVE-2026-76213
36Monitor
phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
phpmyfaq · phpmyfaqAug 19, 2026
CVE-2026-76214
36Monitor
phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
phpmyfaq · phpmyfaqAug 19, 2026
CVE-2017-15808
35Monitor
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- CSRF
phpmyfaq · phpmyfaqOct 23, 2017
CVE-2024-27299
35Monitor
phpMyFAQ SQL Injection at "Save News"
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SQL injection
phpmyfaq · phpmyfaqMar 25, 2024
CVE-2017-15734
35Monitor
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- CSRF
phpmyfaq · phpmyfaqOct 22, 2017
CVE-2017-15735
35Monitor
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- CSRF
phpmyfaq · phpmyfaqOct 22, 2017
CVE-2024-28107
35Monitor
phpMyFAQ SQL injections at insertentry & saveentry
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SQL injection
phpmyfaq · phpmyfaqMar 25, 2024
CVE-2023-1762
35Monitor
Improper Privilege Management in thorsten/phpmyfaq
HighCVSS 8.8No exploitEPSS 1%
phpmyfaq · phpmyfaqMar 30, 2023
CVE-2023-0790
35Monitor
Uncaught Exception in thorsten/phpmyfaq
HighCVSS 8.8No exploitEPSS 1%
phpmyfaq · phpmyfaqFeb 12, 2023