Phpmyfaq is a modestly represented but prominent web-based FAQ management platform that powers knowledge-base and support systems across a wide deployment footprint. Despite a narrow product scope—the platform itself—its vulnerability footprint has an elevated tendency toward public exploit availability, with exposures concentrating in application-layer input handling and access control. The recurring weakness classes span cross-site scripting, cross-site request forgery, SQL injection, and improper access control, reflecting the web-facing nature of FAQ content management and the authentication and data-validation demands of user-editable knowledge bases. Defenders should treat updates to this platform as broadly applicable, particularly where FAQ systems are internet-exposed or handle sensitive organizational content. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpmyfaq over time
Signals from CVEs in this vendor scope (146 CVEs).
146 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-4825HIGH Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2 | Dec 15, 2011 | 7.5 | 63 | NO | YES |
CVE-2022-3766MEDIUM Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8. | Oct 31, 2022 | 6.1 | 42 | NO | YES |
CVE-2014-6046HIGH Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) | Aug 28, 2018 | 8.8 | 39 | NO | YES |
CVE-2026-57995HIGH phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups | Jun 30, 2026 | 8.8 | 38 | NO | NO |
CVE-2025-69200HIGH phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/ | Dec 29, 2025 | 7.5 | 38 | NO | YES |
CVE-2017-15808HIGH In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. | Oct 23, 2017 | 8.8 | 38 | NO | YES |
CVE-2017-15730HIGH In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. | Oct 22, 2017 | 8.8 | 37 | NO | YES |
CVE-2026-56396HIGH phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. | Jun 21, 2026 | 8.8 | 36 | NO | NO |
CVE-2017-15735HIGH In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. | Oct 22, 2017 | 8.8 | 36 | NO | YES |
CVE-2017-15734HIGH In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. | Oct 22, 2017 | 8.8 | 36 | NO | YES |
Signals from CVEs in this vendor scope (146 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpmyfaq.
Media articles that mention a CVE ID that affects a product developed by Phpmyfaq — matched by CVE ID, not by vendor name.