Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: thorsten phpMyFAQ 4.1.3 Clear all filters
TI-2026-27777 CVE-2026-35676 · GHSA-9qv9-8xv6-5p35

phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint

Priority HIGH 77

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00302 Published 2026-05-28 Fixed in 4.1.3 CWE-640
TI-2026-27776 CVE-2026-35675 · GHSA-w9xh-5f39-vq89

phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

Priority HIGH 77

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmati…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00417 Published 2026-05-28 Fixed in 4.1.3 CWE-307
TI-2026-27773 CVE-2026-35672 · GHSA-gp95-j463-vv28

phpMyFAQ - Authentication Bypass via Empty API Token

Priority HIGH 77

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00483 Published 2026-05-28 Fixed in 4.1.3 CWE-1188
TI-2026-27772 CVE-2026-35671 · GHSA-xvp4-phqj-cjr3

phpMyFAQ - Insecure Direct Object Reference in User Password API

Priority HIGH 73

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verifi…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00384 Published 2026-05-28 Fixed in 4.1.3 CWE-266