VulertSecurity VulertSecurity

Vulnerability Database · Packagist · phpmyfaq/phpmyfaq · Version

phpmyfaq/phpmyfaq 4.0.18

4.0.18 is affected by 16 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 0 High 4 Medium 12 Low 0 Unrated 0

All phpmyfaq/phpmyfaq versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

phpmyfaq/phpmyfaq 4.0.18 vulnerabilities

16 vulnerabilities cover phpmyfaq/phpmyfaq 4.0.18. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-57995: phpMyFAQ Privilege Escalation via GroupController::updatePermissions 8.8 high 4.1.5 25 Aug 2026
CVE-2026-34728: phpMyFAQ Path Traversal Vulnerability Leading to Arbitrary File Deletion 8.7 high 4.1.1 01 Apr 2026
CVE-2026-56738: phpMyFAQ SQL Injection Vulnerability in StopWords::add() Method 8.5 high 4.1.6 24 Sep 2026
CVE-2026-46367: phpMyFAQ Stored XSS Vulnerability via Utils::parseUrl() in Comment Rendering 7.6 high 4.1.2 15 May 2026
Stored XSS Vulnerability in phpMyFAQ via Raw Filter in Search Results 6.9 medium 4.1.2 06 May 2026
CVE-2026-45008: phpMyFAQ Path Traversal Vulnerability Allows Directory Deletion by Non-Super-Admin Admins 6.5 medium 4.1.2 15 May 2026
Authorization Bypass Vulnerability in phpMyFAQ: Exposing Admin Data 6.5 medium 4.1.2 06 May 2026
CVE-2026-34729: phpMyFAQ Stored XSS via Regex Bypass in Filter::removeAttributes() 6.1 medium 4.1.1 01 Apr 2026
CVE-2026-46365: phpMyFAQ Tag Deletion Vulnerability Allows Unauthorized Tag Removal 5.4 medium 4.1.2 15 May 2026
CVE-2026-46363: phpMyFAQ Stored XSS Vulnerability via Encode-Decode Bypass 5.4 medium 4.1.2 15 May 2026
CVE-2026-46360: phpMyFAQ SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS 5.4 medium 4.1.2 15 May 2026
Stored XSS Vulnerability in phpMyFAQ Due to SVG Sanitizer Entity Decoding Depth Limit Bypass 5.4 medium 4.1.2 06 May 2026
Stored XSS Vulnerability in phpMyFAQ: Encode-Decode Bypass 5.4 medium 4.1.2 06 May 2026
Unauthorized Tag Deletion Vulnerability in phpMyFAQ 5.4 medium 4.1.2 06 May 2026
CVE-2024-56199: phpMyFAQ Stored HTML Injection Vulnerability 5.2 medium No fix published 02 Jan 2025
CVE-2026-45009: phpMyFAQ Insufficient Authorization Vulnerability Allows Access to Admin-Only API Endpoints 4.3 medium 4.1.2 15 May 2026

Looking for another version, or everything Vulert holds for phpmyfaq/phpmyfaq?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About phpmyfaq/phpmyfaq 4.0.18

Is phpmyfaq/phpmyfaq 4.0.18 vulnerable?

Yes. 16 vulnerabilities in the Vulert database cover phpmyfaq/phpmyfaq 4.0.18: 0 critical, 4 high, 12 medium and 0 low. Each entry above names the fixed version to move to.

How do I monitor phpmyfaq/phpmyfaq for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the phpmyfaq/phpmyfaq version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.