generated 2026-10-18 05:01 UTC
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
In practice: exploitable over the network, requires no privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
In practice: exploitable over the network, requires low privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global editfaq permission and does not verify access to the target FAQ. Authenticated users with editfaq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
In practice: exploitable over the network, requires low privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
In practice: exploitable over the network, requires no privileges, needs user interaction.
References:
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.
In practice: exploitable over the network, requires low privileges, needs no user interaction.
References:
Web / App Stack, published 2026-10-17
Flagged for matching PHP.
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.
References: