Package impact
Packagist / thorsten/phpmyfaq
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-35671 | high | 8.8 | 8.8 | 7h ago | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without… | |||
| CVE-2026-35676 | high | 8.2 | 8.2 | 7h ago | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Att… | |||
| CVE-2026-35675 | high | 8.2 | 8.2 | 7h ago | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verificatio… | |||
| CVE-2026-35672 | high | 7.5 | 7.5 | 7h ago | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers c… |