These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-46360 describes a stored cross-site scripting issue in phpMyFAQ’s SVG sanitization path. The sanitizer’s recursive entity decoding stops after 5 iterations, which can let deeply nested entity encodings survive filtering and reconstruct a dangerous javascript: URL. In the affected workflow, an authenticated user with FAQ_EDIT permission can upload a crafted SVG that later executes arbitrary JavaSc [truncated]
CVE-2026-46359 is an authenticated SQL injection issue affecting phpMyFAQ before 4.1.2. According to the published description, malicious OAuth token claims can reach CurrentUser::setTokenData unsafely, allowing attackers to break out of string literals and execute arbitrary SQL.
CVE-2026-45010 is a critical authentication-bypass issue in phpMyFAQ before 4.1.2. The /admin/check endpoint accepts arbitrary user-id parameters without tying the check to an existing session or enforcing meaningful rate limits, allowing an unauthenticated attacker to brute-force a six-digit TOTP and reach administrative access. Because the flaw defeats the intended second factor, the impact is severe ev [truncated]
CVE-2026-45009 is a medium-severity authorization weakness in phpMyFAQ before 4.1.2. The issue lets a logged-in frontend user reach admin-api routes that should be restricted to privileged administrators. As disclosed, the exposed backend data can include dashboard version details, LDAP configuration, Elasticsearch statistics, and health-check information. This is primarily an access-control failure rathe [truncated]
CVE-2026-45008 affects phpMyFAQ before 4.1.2. A path traversal issue in Client::deleteClientFolder can let an authenticated admin with INSTANCE_DELETE delete directories outside the intended clientFolder scope. The impact is integrity and availability loss through unintended recursive directory deletion.
CVE-2026-45007 is an access-control flaw in phpMyFAQ before 4.1.2. In ConfigurationTabController.php, 12 /admin/api/configuration endpoints used userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT), so any authenticated user could query configuration metadata such as the permission model, cache backend, mail provider, and translation provider. The issue is confidentiality-only, but it we [truncated]