PatchClock

PHP security digest · Packages

thorsten/phpmyfaq security advisories

3 advisories we have followed since September 2026, 3 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 24 Sep 2026

    phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

    Fixed in 4.1.6 · CVE-2026-56738

  2. High 24 Sep 2026

    phpMyFAQ's two-factor authentication login bypasses the password factor

    Fixed in 4.1.6 · CVE-2026-56737

  3. High 24 Sep 2026

    phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

    Fixed in 4.2.0-alpha · CVE-2026-56736

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including thorsten/phpmyfaq, and the version that fixes it.