Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: thorsten phpMyFAQ 4.1.6 Clear all filters
TI-2026-47158 CVE-2026-66399 · GHSA-5w7v-f8fx-865c

phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

Priority HIGH 72

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of…

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00292 Published 2026-07-27 Fixed in 4.1.6 CWE-269
TI-2026-47157 CVE-2026-66398 · GHSA-c4f8-v76x-mwx3

phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

Priority HIGH 76

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files b…

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00411 Published 2026-07-27 Fixed in 4.1.6 CWE-494
TI-2026-47156 CVE-2026-66397 · GHSA-4cv6-9jjm-xp2g

phpMyFAQ before 4.1.6 Path Traversal via category image deletion

Priority HIGH 72

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00398 Published 2026-07-27 Fixed in 4.1.6 CWE-22