phpMyFAQ 4.1.0 Release Candidate
Approved changes feed: RSS · Atom
cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*part: a version: 4.1.0 update: rc
| Vendor | Phpmyfaq (36d5951f-3344-59d3-87f2-c1fb92487bb6) |
|---|---|
| Product | Phpmyfaq (6f356a4b-5559-5157-b7be-8fda97b04dcf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/phpmyfaq/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543339 |
pkg:docker/phpmyfaq/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543340 |
pkg:github/thorsten/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543342 |
pkg:rpm/opensuse/phpmyfaq |
purl2cpe | 2026-06-01 10:12:06.543343 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-69200 |
vulnerable | 2026-06-08 07:41:22.175217 |
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
HIGH (7.5)
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.
Published: 2025-12-29T15:24:51.844Z
Updated: 2025-12-29T16:14:32.476Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68951 |
vulnerable | 2026-06-08 07:41:21.972878 |
phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw
MEDIUM (5.4)
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
Published: 2025-12-29T15:18:58.000Z
Updated: 2025-12-29T16:13:54.598Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.