phpMyFAQ vulnerabilities
We track 5 vulnerabilities in phpMyFAQ products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2026.
Latest phpMyFAQ vulnerabilities
- 8.8 High severity
phpMyFAQ: Improper Privilege Management
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USER_ADD/EDIT/DELETE permissions can call POST /admin/api/u
- 8.8 High severity
phpMyFAQ: Improper Privilege Management
phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator c
- 8.8 High severity
phpMyFAQ: Missing Authorization
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or gra
- 8.0 High severity
phpMyFAQ: Improper Neutralization of Formula Elements in a CSV File
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an adminis
- 7.5 High severity
phpMyFAQ: Generation of Error Message Containing Sensitive Information
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.