KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE…
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request…
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ.…
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to…
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the…
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged…
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own…
Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits…
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET…
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin…
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions.…
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the…
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content.…
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception…
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or…
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the…
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory,…
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding…
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can…
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped…
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete… |
Pozostałe |
CVSS 5,3EPSS 0,21 % | ||
| CVE-2026-111922 Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers… |
Monitoruj |
CVSS 7,2EPSS 0,1 % | ||
| CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the… |
Monitoruj |
CVSS 8,7EPSS 0,29 % | ||
| CVE-2026-111909 phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin… |
Monitoruj |
CVSS 7,2EPSS 0,27 % | ||
| CVE-2026-111910 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by… |
Monitoruj |
CVSS 7,1EPSS 0,28 % | ||
| CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge… |
Wysoki priorytet |
CVSS 9,3EPSS 0,42 % | ||
| CVE-2026-111912 Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum… |
Monitoruj |
CVSS 7,1EPSS 0,18 % | ||
| CVE-2026-111913 Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The… |
Pozostałe |
CVSS 5,3EPSS 0,18 % | ||
| CVE-2026-111914 Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the… |
Monitoruj |
CVSS 7,1EPSS 0,25 % | ||
| CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users.… |
Pozostałe |
CVSS 6,9EPSS 0,27 % | ||
| CVE-2026-111903 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD… |
Pozostałe |
CVSS 5,1EPSS 0,18 % | ||
| CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted… |
Pozostałe |
CVSS 6,9EPSS 0,26 % | ||
| CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full… |
Monitoruj |
CVSS 7,0EPSS 0,41 % | ||
| CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not… |
Monitoruj |
CVSS 7,1EPSS 0,13 % | ||
| CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a… |
Monitoruj |
CVSS 7,1EPSS 0,11 % | ||
| CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by… |
Pozostałe |
CVSS 5,1EPSS 0,22 % | ||
| CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim… |
Monitoruj |
CVSS 7,6EPSS 0,29 % | ||
| CVE-2026-111896 phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split… |
Pozostałe |
CVSS 5,1EPSS 0,17 % | ||
| CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by… |
Monitoruj |
CVSS 7,1EPSS 0,27 % | ||
| CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email.… |
Monitoruj |
CVSS 7,7EPSS 0,34 % | ||
| CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is… |
Pozostałe |
CVSS 5,3EPSS 0,26 % | ||
| CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET… |
Monitoruj |
CVSS 8,7EPSS 0,34 % | ||
| CVE-2026-111888 phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT… |
Pozostałe |
CVSS 5,1EPSS 0,21 % | ||
| CVE-2026-111889 phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin… |
Pozostałe |
CVSS 5,3EPSS 0,2 % | ||
| CVE-2026-111890 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are… |
Monitoruj |
CVSS 7,0EPSS 0,23 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 23:02 UTC – 13.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.