Thorsten

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-46364	Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and SMTP secrets by sending a crafted User-Agent header to the public GET /api/captcha endpoint. The flaw sits in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha(), which interpolate the header into DELETE and INSERT statements via sprintf with no escaping. No public exploit identified at time of analysis, though VulnCheck has published a detailed reachability writeup and a verified time-based blind PoC payload appears in the GHSA advisory.	CRITICAL	9.3	0.0%	67	PoC
CVE-2026-45010	Two-factor authentication bypass in phpMyFAQ before 4.1.2 lets unauthenticated remote attackers brute-force any administrator's six-digit TOTP code by submitting sequential POST requests to the /admin/check endpoint, which lacks session binding and rate limiting. CVSS 4.0 scores this 9.3 with no public exploit identified at time of analysis, though a proof-of-concept is described in the GHSA advisory and SSVC marks exploitation as 'poc' with total technical impact. EPSS is low at 0.12%, reflecting limited observed scanning despite the trivial 10^6 keyspace exhaustible in minutes.	CRITICAL	9.3	0.1%	47
CVE-2026-76214	Authentication bypass via WebAuthn assertion replay in phpMyFAQ affects all versions up to and including 4.1.5, fixed in 4.1.7. Because prepareForLogin generates a login challenge but neither WebAuthn controller writes the mutated key object back to the database, the anti-replay check is short-circuited by its own null guard, so an attacker who captures one successful WebAuthn assertion can resubmit it indefinitely to log in as that user with no hardware key or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well documented in the vendor advisory.	CRITICAL	9.1	0.3%	46
CVE-2026-76213	Two-factor authentication bypass in phpMyFAQ before 4.1.7 lets an attacker who already knows a valid password defeat the TOTP second factor through unbounded brute force. Because the five-attempt failure counter is stored per session and reset on every successful password re-authentication (CWE-307), an attacker can loop - grab a fresh session cookie, re-enter the known password, and get five more guesses - until the 6-digit TOTP is guessed, yielding full account takeover. Reported by VulnCheck with no public exploit identified at time of analysis and not listed in CISA KEV.	CRITICAL	9.1	0.3%	46
CVE-2026-76208	LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.	HIGH	8.8	0.3%	44	No patch
CVE-2026-35675	Authentication bypass in phpMyFAQ before 4.1.3 lets any unauthenticated remote attacker reset arbitrary user passwords - including SuperAdmin - by sending a PUT request to /api/user/password/update with only a valid username/email pair, with no token, rate limit, or out-of-band confirmation. The vendor-issued GHSA-w9xh-5f39-vq89 advisory and VulnCheck disclosure document the flaw, and publicly available exploit code exists in the form of a PoC curl invocation; no CISA KEV listing or EPSS score is provided in the input.	HIGH	8.8	0.1%	44
CVE-2026-35676	Unauthenticated account takeover in phpMyFAQ before 4.1.3 allows remote attackers to forcibly reset any user's password by sending a PUT request to the /api/index.php/user/password/update endpoint with a valid username and email pair. The endpoint also leaks valid credentials through response code differentials (200 vs 409), enabling username/email enumeration before the reset. No public exploit identified at time of analysis, though a detailed PoC is published in the GHSA advisory.	HIGH	8.8	0.0%	44
CVE-2026-75918	Password reset token exposure in phpMyFAQ before 4.1.7 enables unauthenticated account takeover by reading a publicly accessible, date-stamped tracking file. When user tracking is enabled, the application writes password reset tokens to content/core/data/trackingDDMMYYYY without access controls, allowing any network attacker to retrieve the file and replay the token against the reset API. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack path is low-complexity once the preconditions are met.	HIGH	8.7	0.3%	44
CVE-2026-46366	Unauthenticated information disclosure in phpMyFAQ before 4.1.2 lets attackers enumerate all FAQ entries, including restricted ones. By iterating solution IDs via the /solution_id_{id}.html endpoint, the application leaks the existence, internal ID, language, category, and title of every FAQ through HTTP 301 redirect headers and page canonical links. No user interaction is required, and a public proof-of-concept exists, though the CVE is not yet listed in CISA's Known Exploited Vulnerabilities catalog.	HIGH	8.7	0.1%	44
CVE-2026-35671	Privilege escalation in phpMyFAQ before 4.1.3 allows any authenticated low-privilege administrator to take over SuperAdmin (userId=1) or any other account by manipulating the userId parameter in the /admin/api/user/overwrite-password PUT request. The flaw is an insecure direct object reference (IDOR) in the Admin API where authorization checks confirm only that the caller holds the generic USER_EDIT permission, never that the caller is authorized to manage the targeted account. No public exploit identified at time of analysis, but the GHSA advisory from the vendor (thorsten) publicly documents the exact vulnerable code path, making weaponization trivial.	HIGH	8.7	0.0%	44	PoC
CVE-2026-35672	Authentication bypass in phpMyFAQ versions prior to 4.1.3 lets remote unauthenticated attackers create and modify FAQ entries, categories, and questions through the REST API v4.0 by submitting an empty x-pmf-token header that matches the default empty api.apiClientToken value. The flaw stems from strict string comparison logic that cannot distinguish an unconfigured token from an attacker-supplied empty one, exposing every default installation. No public exploit identified at time of analysis, but the GHSA advisory includes a detailed proof-of-concept walkthrough.	HIGH	8.7	0.1%	44
CVE-2026-76207	Two-factor authentication bypass in phpMyFAQ before 4.1.7 allows any attacker holding valid first-factor credentials to obtain a remember-me cookie prior to 2FA challenge completion, then replay that cookie to achieve full authenticated access while entirely circumventing the second-factor control. Affected deployments relying on 2FA as their primary defense-in-depth layer against credential compromise are effectively left with single-factor authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass logic is straightforward and the vulnerability is trivially reproducible given valid credentials.	HIGH	8.6	0.3%	43
CVE-2026-76205	SQL injection in phpMyFAQ before 4.1.7 allows authenticated low-privileged users to exfiltrate and manipulate database contents via the glossary create and update endpoints. The flaw stems from a string truncation defect that breaks SQL escaping: when an escaped string is truncated before embedding in a SQL literal, a trailing backslash can dangle, escaping the closing quote and allowing arbitrary SQL injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects serious potential for sensitive data exposure.	HIGH	8.6	0.2%	43
CVE-2026-46367	Stored cross-site scripting in phpMyFAQ 4.1.1 lets any authenticated user with a registered account persist JavaScript inside FAQ or News comments by submitting a URL containing an unescaped double quote, which Utils::parseUrl() injects unescaped into an href attribute. Payloads execute for every visitor - including admins viewing the comments panel - enabling session cookie theft and full application takeover. Publicly available exploit code exists in the GHSA advisory, though EPSS is only 0.01% and SSVC categorizes exploitation as POC rather than active.	HIGH	8.3	0.0%	42
CVE-2026-46361	Stored cross-site scripting in phpMyFAQ before 4.1.2 lets FAQ editors persist HTML-entity-encoded JavaScript that survives sanitization and executes in every visitor's browser, including administrators. The flaw stems from Twig's `\| raw` filter being applied to `result.question` and `result.answerPreview` in `search.twig`, combined with a `html_entity_decode(strip_tags())` round-trip in SearchController.php that resurrects encoded tags. Publicly available exploit code exists (POC per SSVC), though EPSS is 0.01% and the issue is not on the CISA KEV list.	HIGH	8.2	0.0%	41

CVE-2026-46364

Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and SMTP secrets by sending a crafted User-Agent header to the public GET /api/captcha endpoint. The flaw sits in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha(), which interpolate the header into DELETE and INSERT statements via sprintf with no escaping. No public exploit identified at time of analysis, though VulnCheck has published a detailed reachability writeup and a verified time-based blind PoC payload appears in the GHSA advisory.

CRITICAL

9.3

0.0%

67

PoC

CVE-2026-45010

Two-factor authentication bypass in phpMyFAQ before 4.1.2 lets unauthenticated remote attackers brute-force any administrator's six-digit TOTP code by submitting sequential POST requests to the /admin/check endpoint, which lacks session binding and rate limiting. CVSS 4.0 scores this 9.3 with no public exploit identified at time of analysis, though a proof-of-concept is described in the GHSA advisory and SSVC marks exploitation as 'poc' with total technical impact. EPSS is low at 0.12%, reflecting limited observed scanning despite the trivial 10^6 keyspace exhaustible in minutes.

CRITICAL

9.3

0.1%

47

CVE-2026-76214

Authentication bypass via WebAuthn assertion replay in phpMyFAQ affects all versions up to and including 4.1.5, fixed in 4.1.7. Because prepareForLogin generates a login challenge but neither WebAuthn controller writes the mutated key object back to the database, the anti-replay check is short-circuited by its own null guard, so an attacker who captures one successful WebAuthn assertion can resubmit it indefinitely to log in as that user with no hardware key or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well documented in the vendor advisory.

CRITICAL

9.1

0.3%

46

CVE-2026-76213

Two-factor authentication bypass in phpMyFAQ before 4.1.7 lets an attacker who already knows a valid password defeat the TOTP second factor through unbounded brute force. Because the five-attempt failure counter is stored per session and reset on every successful password re-authentication (CWE-307), an attacker can loop - grab a fresh session cookie, re-enter the known password, and get five more guesses - until the 6-digit TOTP is guessed, yielding full account takeover. Reported by VulnCheck with no public exploit identified at time of analysis and not listed in CISA KEV.

CRITICAL

9.1

0.3%

46

CVE-2026-76208

LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.

HIGH

8.8

0.3%

44

No patch

CVE-2026-35675

Authentication bypass in phpMyFAQ before 4.1.3 lets any unauthenticated remote attacker reset arbitrary user passwords - including SuperAdmin - by sending a PUT request to /api/user/password/update with only a valid username/email pair, with no token, rate limit, or out-of-band confirmation. The vendor-issued GHSA-w9xh-5f39-vq89 advisory and VulnCheck disclosure document the flaw, and publicly available exploit code exists in the form of a PoC curl invocation; no CISA KEV listing or EPSS score is provided in the input.

HIGH

8.8

0.1%

44

CVE-2026-35676

Unauthenticated account takeover in phpMyFAQ before 4.1.3 allows remote attackers to forcibly reset any user's password by sending a PUT request to the /api/index.php/user/password/update endpoint with a valid username and email pair. The endpoint also leaks valid credentials through response code differentials (200 vs 409), enabling username/email enumeration before the reset. No public exploit identified at time of analysis, though a detailed PoC is published in the GHSA advisory.

HIGH

8.8

0.0%

44

CVE-2026-75918

Password reset token exposure in phpMyFAQ before 4.1.7 enables unauthenticated account takeover by reading a publicly accessible, date-stamped tracking file. When user tracking is enabled, the application writes password reset tokens to content/core/data/trackingDDMMYYYY without access controls, allowing any network attacker to retrieve the file and replay the token against the reset API. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack path is low-complexity once the preconditions are met.

HIGH

8.7

0.3%

44

CVE-2026-46366

Unauthenticated information disclosure in phpMyFAQ before 4.1.2 lets attackers enumerate all FAQ entries, including restricted ones. By iterating solution IDs via the /solution_id_{id}.html endpoint, the application leaks the existence, internal ID, language, category, and title of every FAQ through HTTP 301 redirect headers and page canonical links. No user interaction is required, and a public proof-of-concept exists, though the CVE is not yet listed in CISA's Known Exploited Vulnerabilities catalog.

HIGH

8.7

0.1%

44

CVE-2026-35671

Privilege escalation in phpMyFAQ before 4.1.3 allows any authenticated low-privilege administrator to take over SuperAdmin (userId=1) or any other account by manipulating the userId parameter in the /admin/api/user/overwrite-password PUT request. The flaw is an insecure direct object reference (IDOR) in the Admin API where authorization checks confirm only that the caller holds the generic USER_EDIT permission, never that the caller is authorized to manage the targeted account. No public exploit identified at time of analysis, but the GHSA advisory from the vendor (thorsten) publicly documents the exact vulnerable code path, making weaponization trivial.

HIGH

8.7

0.0%

44

PoC

CVE-2026-35672

Authentication bypass in phpMyFAQ versions prior to 4.1.3 lets remote unauthenticated attackers create and modify FAQ entries, categories, and questions through the REST API v4.0 by submitting an empty x-pmf-token header that matches the default empty api.apiClientToken value. The flaw stems from strict string comparison logic that cannot distinguish an unconfigured token from an attacker-supplied empty one, exposing every default installation. No public exploit identified at time of analysis, but the GHSA advisory includes a detailed proof-of-concept walkthrough.

HIGH

8.7

0.1%

44

CVE-2026-76207

Two-factor authentication bypass in phpMyFAQ before 4.1.7 allows any attacker holding valid first-factor credentials to obtain a remember-me cookie prior to 2FA challenge completion, then replay that cookie to achieve full authenticated access while entirely circumventing the second-factor control. Affected deployments relying on 2FA as their primary defense-in-depth layer against credential compromise are effectively left with single-factor authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass logic is straightforward and the vulnerability is trivially reproducible given valid credentials.

HIGH

8.6

0.3%

43

CVE-2026-76205

SQL injection in phpMyFAQ before 4.1.7 allows authenticated low-privileged users to exfiltrate and manipulate database contents via the glossary create and update endpoints. The flaw stems from a string truncation defect that breaks SQL escaping: when an escaped string is truncated before embedding in a SQL literal, a trailing backslash can dangle, escaping the closing quote and allowing arbitrary SQL injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects serious potential for sensitive data exposure.

HIGH

8.6

0.2%

43

CVE-2026-46367

Stored cross-site scripting in phpMyFAQ 4.1.1 lets any authenticated user with a registered account persist JavaScript inside FAQ or News comments by submitting a URL containing an unescaped double quote, which Utils::parseUrl() injects unescaped into an href attribute. Payloads execute for every visitor - including admins viewing the comments panel - enabling session cookie theft and full application takeover. Publicly available exploit code exists in the GHSA advisory, though EPSS is only 0.01% and SSVC categorizes exploitation as POC rather than active.

HIGH

8.3

0.0%

42

CVE-2026-46361

Stored cross-site scripting in phpMyFAQ before 4.1.2 lets FAQ editors persist HTML-entity-encoded JavaScript that survives sanitization and executes in every visitor's browser, including administrators. The flaw stems from Twig's `| raw` filter being applied to `result.question` and `result.answerPreview` in `search.twig`, combined with a `html_entity_decode(strip_tags())` round-trip in SearchController.php that resurrects encoded tags. Publicly available exploit code exists (POC per SSVC), though EPSS is 0.01% and the issue is not on the CISA KEV list.

HIGH

8.2

0.0%

41

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs