phpmyfaq has 6 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The median CVSS is 7.8 (high). None have a confirmed exploitation report. Most affected products: phpmyfaq (5), phpmyfaq/phpmyfaq (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-76208High· 8.2phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create()57CVE-2025-69200High· 7.5phpMyFAQ is an open source FAQ web application54GHSA-pg62-f8g4-4wqhHigh· 8.8phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold48CVE-2025-59943High· 8.1phpMyFAQ is an open source FAQ web application45CVE-2025-62519High· 7.2phpMyFAQ is an open source FAQ web application40
phpmyfaq vulnerabilities
CVEs affecting phpmyfaq, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
GHSA-pg62-f8g4-4wqhHigh· 8.8phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
CVE-2026-76208High· 8.2PoCphpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create()
phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which…
CVE-2025-69200High· 7.5PoCphpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a …
CVE-2025-68951Medium· 5.4phpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user…
CVE-2025-62519High· 7.2phpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissio…
CVE-2025-59943High· 8.1phpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Be…