WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
phpMyFAQ 4.0.0 through 4.1.8 allows unauthenticated remote attackers to take over arbitrary user accounts through its WebAuthn/passkey registration flow. The registration endpoint attaches a new passkey to a staged username without requiring an existing session or validating the WebAuthn challenge, so a forged fmt=none attestation can register an attacker-controlled credential; subsequent passkey login bypasses password and TOTP checks. No public exploit code was identified at time of analysis, and affected instances should be upgraded to 4.1.9 or later.
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.
OS command injection in the FILESystem:MOUNT:DRIve SCPI command handler of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated, low-privileged attackers who can reach the instrument's remote-control interface to execute arbitrary operating system commands with elevated privileges (CVSS 8.8, CWE-78, PR:L/UI:N). Any 3 Series MDO that exposes its SCPI control interface (LAN/VXI-11 or raw socket) to a lab or engineering network is in scope, and the attack requires no user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the available data, so the realistic risk is concentrated on network-exposed instruments rather than mass exploitation.
Unauthenticated denial of service in FleetDM Fleet before 4.83.0 allows remote attackers to exhaust server memory by sending small, highly gzip-compressed HTTP request bodies to unauthenticated endpoints, where decoding expands them and crashes the entire Fleet instance. No credentials, user interaction, or special configuration are required beyond network reachability, so internet-exposed Fleet servers are the highest priority. No public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, but the low attack complexity and unauthenticated path make this a credible availability threat.
Unauthenticated denial-of-service in Fleet Device Management before 4.89.0 allows remote attackers to crash the server by sending a crafted binary property list to Apple MDM enrollment endpoints. The payload, roughly 150 bytes, triggers unbounded recursion or exponential allocation that exhausts CPU and memory. Exploitation requires Apple MDM enrollment to be configured and the enrollment endpoints to be network-reachable; impact is availability-only, with no data access or code execution, and no public exploit identified at time of analysis.
Unauthenticated denial of service in phpMyFAQ 4.2.0-alpha allows remote attackers to exhaust server memory and CPU by sending concurrent GET requests to the faqs and search API endpoints, which load and process all database records into PHP memory. Only the 4.2.0-alpha pre-release line before 4.2.0-beta is affected; patched 4.2.0-beta+ and stable-release deployments are not exploitable, and impact is limited to availability with no data exposure or code execution. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta allows authenticated users holding the global edit_faq permission to modify restricted FAQ entries through the PUT /api/v3.1/faq/update endpoint without object-level access checks. An attacker with such an account can change content, bypass moderation, and alter publication state for FAQs they cannot view; the risk is conditional on broad edit_faq grants and REST API exposure. The issue is rated CVSS 8.7 (v4.0) and no public exploit identified at time of analysis.
Credential theft in Coder (before 2.29.20, 2.33.0 through 2.33.11, 2.34.0 through 2.34.7, and 2.35.0 through 2.35.3) lets a remote attacker who controls a hostname that is a string prefix of a configured workspace-proxy access URL have that hostname accepted as a trusted proxy by GetWorkspaceProxyByHostname. The attacker then lures an already-authenticated user to a crafted /api/v2/applications/auth-redirect link, captures the redirected application_connect API key, and replays it to reach the victim's workspace applications (CWE-522). Exploitation is constrained by the need for a configured workspace proxy, a suitably prefix-shaped attacker domain, and victim interaction, so it is a targeted rather than opportunistic attack; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Account takeover is possible in phpMyFAQ before 4.1.9 and in 4.2.0-alpha before 4.2.0-beta when an attacker who already holds a valid session and matching CSRF token changes the victim's e-mail address through the user control panel without supplying the current password. The attacker can then use the password-reset flow to seize non-2FA accounts, including superadmin. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, although the real-world footprint is modest; no public exploit has been identified at time of analysis.
phpMyFAQ instances using Keycloak or Entra ID OIDC SSO can issue a fully authenticated session without enforcing TOTP for accounts that have 2FA enabled, including administrator accounts. The flaw affects 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta and requires a valid or phished IdP identity already linked to the target account; no public exploit was identified at time of analysis. It is a genuine CWE-287 authentication bypass rated CVSS 8.6, but exploitation is gated by that linked-identity prerequisite rather than being a mass unauthenticated attack.
Privilege escalation in phpMyFAQ 4.2.0-alpha pre-release builds lets a category-restricted delegated administrator escape their assigned scope and grant groups unrestricted category access. The flaw resides in GroupController::saveCategoryRestrictions(), which fails to validate submitted categoryIds against the caller's own scope, so a crafted POST to /admin/api/group/category-restrictions with out-of-scope or empty values elevates the attacker's effective permissions. Exploitation requires valid credentials for a privileged but scope-limited admin role (PR:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis; the affected range is a pre-release train that is unlikely to be widely deployed in production.
Heap out-of-bounds write in FreeRDP's RDP server NTLM hash-callback path lets unauthenticated remote attackers corrupt memory by supplying a crafted AUTHENTICATE_MESSAGE with backward session-key and MIC offsets. The bug affects FreeRDP 2.0.0 through versions before 3.32.0 and is only reachable when FreeRDP is acting as an RDP server using the NTLM hash-callback code path, not in client-only deployments; the fixed 16-byte zero write limits the primitive but still yields high integrity and availability impact. No public exploit identified at time of analysis, and the high attack complexity plus attack preconditions make reliable exploitation conditional rather than broadly opportunistic.
Path traversal in the SCPI FILESystem command interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated remote attackers to read or modify arbitrary files on the device. The vulnerability arises from insufficient validation of file paths supplied to filesystem access commands and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exposure is typically limited because the SCPI interface is usually confined to lab or test networks rather than the public internet.
Arbitrary shortcode execution in the User Registration & Membership WordPress plugin through 5.2.8 lets unauthenticated attackers place registered shortcodes into the HTTP Referer header so they are executed when a restricted page renders a Content Restriction message containing the {{referrer_url}} smart tag. The vulnerable path is UR_Smart_Tags::process(), where sanitize_text_field() leaves shortcode delimiters intact before the message is passed to apply_shortcodes()/do_shortcode(); impact is bounded to shortcodes registered on the target site. Exploitation requires the non-default Content Restriction configuration described above; no public exploit was identified at time of analysis, no CISA KEV confirmation was provided, and no EPSS score was supplied.
Account takeover in phpMyFAQ's Keycloak single sign-on integration allows a holder of a Keycloak identity whose preferred_username collides with, or whose unverified email matches, an existing local phpMyFAQ account to bind that local account to their own Keycloak subject and inherit its privileges, including superadmin. Only pre-release builds from 4.2.0-alpha up to but not including 4.2.0-beta are affected, and exploitation additionally requires Keycloak to be explicitly configured as an identity provider with the /auth/keycloak/authorize flow and implicit account linking active, so the realistic attack surface is limited to non-default test and staging deployments (CVSS 4.0 base 7.7; PR:L, AC:H, AT:P per the assessed vector). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Account takeover in phpMyFAQ (3.2.0 to before 4.0.0, and 4.0.2 to before 4.2.0-beta) lets an authenticated attacker who controls an identity in the configured Microsoft Entra ID tenant hijack an existing local account, including super-admin, by presenting a preferred_username that exactly matches that account. The flaw exists because the Entra ID login handler links users by the mutable preferred_username claim and AuthEntraId::create() ignores the duplicate-login exception, continuing with the pre-existing local account instead of failing closed. Exploitation is conditional - the instance must have Entra ID SSO enabled and the attacker must already possess valid tenant access (PR:L) plus an exact username match - and no public exploit code has been identified at time of analysis.
Path traversal in the web management interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 lets remote attackers read arbitrary files accessible to the web application by supplying insufficiently validated file paths. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), but unauthenticated exploitation depends on device configuration - deployments that require login to the web interface reduce the practical risk to authenticated users. Impact is limited to confidentiality (file reads, no write or code execution); no public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is bounded by these instruments typically residing on isolated lab networks rather than the internet.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Error messages produced by the Gantry 5 Framework - a theme framework used by WordPress (and historically Joomla) sites - can embed sensitive data that unauthenticated remote users may retrieve, affecting all releases through 5.6.4. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the exposure is network-reachable at low complexity with no privileges or user interaction required, and the impact is high confidentiality loss only, with no integrity or availability effect. The Patchstack advisory does not specify which request or error condition triggers the disclosure, no public exploit code was identified at time of analysis, and the framework has not been added to CISA KEV; the practical severity therefore depends on what secrets the failing code path actually embeds. No public exploit identified at time of analysis.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
Stored cross-site scripting in the GetPaid WordPress plugin through 2.8.61 allows unauthenticated attackers to submit a payment form containing a malicious 'mmdwqzpoxadd' parameter, which is stored without adequate sanitization or output escaping and later executes when an administrator opens the affected invoice's Payment Form Details metabox. Exploitation is assisted by the plugin publicly exposing the required getpaid_form_nonce to all visitors as WPInv.formNonce, so the nonce does not serve as an authentication barrier, but the stored payload still requires a privileged administrator to view the specific invoice metabox. This is a moderate, not top-tier, priority; no public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.
Stored cross-site scripting in the European VAT Compliance Assistant for WooCommerce plugin (all versions through 1.36.10) allows unauthenticated attackers to plant arbitrary script by controlling the CF-IPCountry header during a guest checkout; the value is persisted verbatim in order post-meta and executes when a store administrator views the order in wp-admin. The main constraint is header controllability - CF-IPCountry is normally set by Cloudflare, so injection is practical only where the store is not behind Cloudflare or the edge does not overwrite client-supplied values - and a privileged user must subsequently open the affected order. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the unauthenticated planting path and execution in the admin context warrant prompt patching.
Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.
Stored cross-site scripting in the User Registration & Membership WordPress plugin (all versions up to and including 5.2.8) lets unauthenticated remote attackers plant arbitrary JavaScript by submitting a crafted Checkbox Field value through the plugin's public registration form. Because the nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without any nonce validation, no account or valid token is required - the payload is persisted and later executes in the browser of anyone who views the injected page, most consequentially an administrator reviewing registrations. There is no public exploit code or CISA KEV entry at time of analysis, and the assessed impact is bounded to browser-context confidentiality and integrity (CVSS 7.2, scope changed) rather than server compromise, making this above-average priority but not emergency-tier.
FreeRDP's WinPR BMP writer contains an integer underflow that can crash the RDP client or cause an out-of-bounds write when a malicious or compromised RDP server sends a crafted 1-bpp clipboard image. The issue affects FreeRDP 3.14.1 up to but not including 3.32.0 and is reachable only when clipboard redirection/synchronization is active and CF_DIB/CF_DIBV5 image synthesis processes the server-supplied BMP. Exploitation is client-side and requires the victim to initiate the RDP connection; no public exploit was identified at time of analysis.
Account takeover in Vikunja 2.2.0 through 2.6.0 stems from a default CORS policy that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set, so a page served from any local port can call the token refresh endpoint and read the returned bearer JWT. The attack is conditional rather than mass-exploitable: the attacker must be able to host malicious content on the victim's own machine, and the victim must have an active authenticated session; it is not directly exploitable from an arbitrary external internet origin. No public exploit identified at time of analysis.
Missing authorization in phpMyFAQ before 4.1.9 allows authenticated non-superadmin accounts that hold the delete_user permission to delete superadmin users and strip administrative accountability from the application. The /admin/api/user/delete endpoint accepts a superadmin userId other than the protected userId 1, so an attacker with a low-privilege admin session can remove higher-privileged administrators; confidentiality is unaffected while integrity and availability impacts are high. No public exploit was identified at time of analysis, and exploitation is gated by the specific delete_user permission rather than being available to every authenticated user.
Vikunja 0.22.0 through 2.6.0 fails to revoke webhook and link-share channels when a collaborator's project access is removed, so a former collaborator who created a webhook while still authorized continues to receive task titles and descriptions - including content created after revocation - as an automatic live feed. The cleanup routine that deletes derived rows (assignees, subscriptions) does not include webhooks or link shares, and it is only wired to the team-member removal path, leaving direct project-user removal, permission downgrade, and team-project removal without any cleanup. Per the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H), the attacker must have been a legitimate authenticated collaborator who previously registered a webhook, gains read-only disclosure only, and no public exploit code has been identified at time of analysis.
Revoked Vikunja sessions retain live WebSocket access: in versions 2.3.0 through 2.6.0 the /api/v2/ws endpoint authenticates the first client message by verifying only the JWT signature and token type, never resolving the token's 'sid' claim against the sessions table, so a stolen access token can still open a new connection or keep an existing one alive after DELETE /api/v2/user/sessions/{id} or after TOTP enrollment wipes all sessions. The impact is confidentiality-only: the attacker continues to receive notification.created pushes carrying comment, task and project content belonging to the victim's account, which the vendor scores 7.1 under CVSS 4.0 (PR:L, VC:H) and our assessment scores 6.5 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an authenticated attacker who already holds a valid, unexpired user access token - there is no initial-access path in this defect - and no public exploit code or CISA KEV entry was identified at time of analysis.
An authorization bypass in phpMyFAQ 4.2.0-alpha (fixed in 4.2.0-beta) lets category-restricted editors in 'medium permission mode' manage attachments belonging to FAQs outside their assigned categories by supplying arbitrary record_id or attachment IDs to the upload and delete endpoints. An attacker who already holds a legitimate but limited editor account can therefore upload, tamper with, or delete files on unauthorized FAQs, affecting attachment integrity and, to a lesser extent, availability, with no confidentiality exposure. The flaw requires authenticated editor credentials (PR:L) and is not reachable by anonymous users; no public exploit code has been identified at time of analysis.
Information disclosure in Admidio 5.0.11 through 5.0.15 allows authenticated users to read every inventory item record and keeper name even when the inventory module is administratively disabled. Any valid login is sufficient, including ordinary members or self-registered accounts where open registration is enabled, because modules/inventory/inventory_data.php does not re-check inventory_module_enabled before returning the DataTables JSON feed. No public exploit code has been identified at time of analysis, and the vendor has released Admidio 5.0.16 to correct the access-control gap.
Missing brute-force lockout in the phpMyFAQ /api/user/remove-twofactor endpoint allows an attacker who already holds a hijacked authenticated session and a matching CSRF token to submit unlimited TOTP guesses and permanently disable the victim's two-factor authentication. The flaw affects phpMyFAQ 4.2.0-alpha.2 through versions before 4.2.0-beta and is a second-stage, session-dependent attack rather than a directly exploitable remote compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is limited to integrity of the victim's 2FA setting, with no confidentiality or availability impact per the assessed vector.
phpMyFAQ releases before 4.1.9, and 4.2.0-alpha builds before 4.2.0-beta, expose attachments belonging to restricted FAQ records through attachment.php, which verifies only that the caller may download attachments in general rather than that the caller may see the FAQ record owning the requested file. Any authenticated account holding the dlattachment right can enumerate attachment IDs and retrieve confidential files, and anonymous visitors can do the same when the administrator has enabled the non-default allowDownloadsForGuests option. The reporter rates it 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VC:H), while the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H with confidentiality-only impact and no effect on integrity or availability; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Reflected cross-site scripting in PAYCOMET for WooCommerce through version 5.45 allows a remote attacker to execute arbitrary script in a victim’s browser by luring them to a crafted URL that reflects an unsanitized parameter. The flaw requires user interaction and affects WordPress sites running this WooCommerce payment gateway; the attacker does not need credentials, but impact is limited to the victim’s session and the affected page. No public exploit code or CISA KEV entry was identified at time of analysis.
Reflected cross-site scripting in the Heateor Fancy Comments WordPress plugin through 1.2.21 allows remote attackers to execute script in a victim’s browser when a crafted URL is visited, because an input parameter is reflected without proper neutralization. The flaw is assessed as CVSS 7.1 High and requires the victim to click an attacker-supplied link (UI:R), while no authentication is needed (PR:N); affected sites are those running the vulnerable plugin with it active. Impact is confined to the victim’s browser session rather than server compromise, and the supplied data reports no public exploit identified at time of analysis, with CISA KEV status not provided.
Authenticated members can overwrite other users' forum topic titles and first posts in Admidio 5.0.0 through 5.0.15 because ForumService::saveTopic() fails to verify that the supplied topic_uuid belongs to the requester. The flaw is an insecure direct object reference (CWE-639) reachable over the network with low privileges (PR:L) and no user interaction; impact is integrity-only, with no confidentiality or availability effect per the assessed CVSS 3.1 vector. No public exploit was identified at time of analysis, and the vendor addressed the missing ownership check in 5.0.16; this is a genuine but moderate-priority authorization flaw, not a critical one.
Cross-site request forgery in phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta allows an attacker to induce a privileged administrator into deleting or rebuilding Elasticsearch/OpenSearch indexes through the administration API. The flaw affects only instances with the Elasticsearch/OpenSearch integration configured; the attacker must lure a victim who is logged in with CONFIGURATION_EDIT permission to a malicious page, whereupon the create, drop, and import actions execute without CSRF token validation. No public exploit code has been identified at time of analysis, and the CVSS 4.0 base score is 7.1.
Cross-site request forgery in phpMyFAQ 4.0.0 through 4.1.8 lets remote attackers induce a privileged administrator to execute database migrations via the POST /admin/api/update-database endpoint, which lacks CSRF token validation. The flaw requires an authenticated victim with CONFIGURATION_EDIT permission to be lured into a crafted request, and it can degrade database integrity and availability; no public exploit identified at time of analysis. Upgrading to 4.1.9 or later remediates the issue (CVSS 4.0: 7.1).
phpMyFAQ versions 3.2.0 through 4.1.8 and the 4.2.0-alpha pre-release line before 4.2.0-beta expose an insecure direct object reference in the admin API endpoint GET /admin/api/user/data/{userId}, allowing a delegated administrator with user-management rights to read another user's full faquserdata row, including a live TOTP secret. The flaw is privilege-gated rather than anonymously exploitable: an attacker must already hold an authenticated backend account with delegated user-management permissions, but can then undermine two-factor authentication for a targeted privileged account by generating valid TOTP codes. No public exploit identified at time of analysis; the primary risk is to installations that delegate user administration to non-SuperAdmin accounts.
Missing privilege-level checks in phpMyFAQ's GroupController::deleteGroup() let an authenticated administrator who holds only the GROUP_DELETE permission permanently destroy higher-privileged groups by sending a crafted groupId to /admin/api/group/delete, stripping those groups' members of inherited rights. Exposure is confined to the 4.2.0 development line from 4.2.0-alpha up to but not including 4.2.0-beta, which the vendor advisory identifies as the fixed release. Attackers must already hold a delegated, non-SuperAdmin admin account, and no public exploit code has been identified at time of analysis.
Privilege escalation in phpMyFAQ builds from 4.2.0-alpha.2 up to but not including 4.2.0-beta allows a non-superadmin administrator who holds GROUP_EDIT to abuse the group permission API's updatePermissions and updateMembers endpoints, grant a group rights beyond the attacker's language or category scope, and self-join that group to obtain unrestricted FAQ create, edit, and publish access across all languages and categories. The CVSS 4.0 base score is 7.0, but exploitation requires an authenticated scoped administrator account and is only meaningful in deployments that use delegated administration limited by language or category, since a single-superadmin installation offers no scoped boundary to escalate from. No public exploit identified at time of analysis.
Privilege escalation in phpMyFAQ pre-release builds (4.2.0-alpha.2 through versions before 4.2.0-beta) allows an administrator holding the USER_EDIT right to re-grant FAQ rights in a way that silently discards per-right language restrictions, yielding unrestricted create, edit, and publish access across every language. The flaw lives in UserController::updateUserRights and can be triggered against the attacker's own account by submitting a language-scoped rights update to the update-rights API. Exploitation is access-gated: it requires an authenticated operator with USER_EDIT (PR:H) and only affects the 4.2.0 development line, so stable installations outside that range are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Admidio before 5.0.16 discloses the names, URLs, descriptions, categories, and creator names of role-restricted weblinks to unauthenticated remote users through the rss/links.php RSS feed. The endpoint omits the category_view role-visibility filter, so anyone who can reach an organization's weblinks feed can read metadata from LNK categories that should be limited to specific roles; the vendor CVSS 4.0 score is 6.9, while the independent CVSS 3.1 assessment rates confidentiality impact Low (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code was identified at time of analysis, and practical exposure depends on the target organization actually using restricted weblink categories and the RSS endpoint being reachable.
Authorization bypass in phpMyFAQ 4.2.0-alpha allows unauthenticated remote attackers to read comments and attachment listings of unpublished or ACL-restricted FAQs by sending a mismatched Accept-Language header to the comments and attachments API endpoints. The flaw exists in isFaqAccessibleForUser() when a FAQ lacks a translation for the requested language, causing it to be treated as publicly visible. No public exploit identified at time of analysis; the issue affects only pre-release alpha builds before 4.2.0-beta, and patched or stable deployments are unaffected.
Account enumeration in phpMyFAQ (releases before 4.1.9, and 4.2.0-alpha builds prior to 4.2.0-beta) lets unauthenticated remote attackers submit candidate display-name and email values to the guest comment endpoint and learn from a distinct HTTP 409 response whether that pair belongs to a registered user. The impact is limited to confirming existing name/email combinations rather than any credential, session, or stored-data compromise, so this is a low-to-moderate priority information-disclosure issue whose practical value scales with the size of the user base and the attacker's prior knowledge of candidate identities. No public exploit code or confirmed active exploitation was identified at time of analysis; realistic abuse is reconnaissance for targeted phishing and account harvesting.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints, allowing remote unauthenticated attackers to send unlimited reset requests that flood a registered user's inbox and consume mailer and server resources. The assessed impact is limited to availability and integrity (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L; supplied CVSS 4.0 score 6.9), with no confidentiality exposure. No public exploit code was identified at time of analysis, and no CISA KEV entry was provided.
Unauthenticated information disclosure in phpMyFAQ 4.2.0-alpha lets remote attackers read hidden open questions and their associated usernames through the /api/v4.0/open-questions REST endpoint. An inverted api.onlyPublicQuestions check inside OpenQuestionController causes the API to return non-public moderation content instead of filtering it, which exposes internal question queues that were never meant to be public. The affected window is narrow - only pre-release 4.2.0-alpha builds before 4.2.0-beta - and 4.2.0-beta corrects the logic; no public exploit code or confirmed active exploitation was identified at time of analysis, and the impact is capped at low-confidentiality read access to moderately sensitive content.