Export limit exceeded: 409952 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409952 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111911 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 9.8 Critical |
| phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover. | ||||
| CVE-2026-111910 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 6.5 Medium |
| phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs. | ||||
| CVE-2026-111908 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 8.3 High |
| phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state. | ||||
| CVE-2026-111907 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 7.1 High |
| phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability. | ||||
| CVE-2026-111906 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 6.5 Medium |
| phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources. | ||||
| CVE-2026-111905 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 6 Medium |
| phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication. | ||||
| CVE-2026-111903 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.4 Medium |
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions. | ||||
| CVE-2026-111902 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.3 Medium |
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs. | ||||
| CVE-2026-111901 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 7.5 High |
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server. | ||||
| CVE-2026-111900 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 4.3 Medium |
| phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs. | ||||
| CVE-2026-111897 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 7.1 High |
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs. | ||||
| CVE-2026-111896 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.4 Medium |
| phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file. | ||||
| CVE-2026-111895 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 6.8 Medium |
| phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts. | ||||
| CVE-2026-111894 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.4 Medium |
| phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers. | ||||
| CVE-2026-111892 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 6.5 Medium |
| phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources. | ||||
| CVE-2026-111891 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.5 Medium |
| phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories. | ||||
| CVE-2026-111890 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-17 | 5.5 Medium |
| phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages. | ||||
| CVE-2026-111881 | 1 Freerdp | 1 Freerdp | 2026-10-17 | 7.6 High |
| FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write. | ||||
| CVE-2026-111880 | 1 Freerdp | 1 Freerdp | 2026-10-17 | 7.4 High |
| FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation. | ||||
| CVE-2025-71435 | 1 Coder | 1 Coder | 2026-10-17 | 4.2 Medium |
| Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization. | ||||