phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
CVE-2026-85593
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks
#advisory
共收录 23717 条相关情报。
← 返回所有主题phpMyFAQ before 4.1.8 Authorization Bypass via question/create
CVE-2026-85592
phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddin
phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
CVE-2026-85591
phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint tha
phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
CVE-2026-85590
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable fu
phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
CVE-2026-85589
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints search
phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
CVE-2026-85588
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attacker
phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
CVE-2026-85587
phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
CVE-2026-85586
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission
SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
CVE-2026-85585
SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that
SiYuan before v3.8.2 Denial of Service via Auth Throttle
CVE-2026-85584
SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that
SiYuan before v3.8.2 Path Traversal via symlink in file API
CVE-2026-85583
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo
SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
CVE-2026-85582
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth hand
SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
CVE-2026-85581
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that
SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
CVE-2026-85580
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se
SiYuan before v3.8.2 Information Disclosure via undoState
CVE-2026-85579
SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-acces
SiYuan through 3.8.1 Authorization Bypass via getFile
CVE-2026-85578
SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows reader
Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
CVE-2026-85547
A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disable
MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
CVE-2026-85546
MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOr
MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
CVE-2026-85538
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite la
MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
CVE-2026-85533
An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user