Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:51:31 +0000 CVE-2026-76215 — phpMyFAQ before 4.1.7 Missing Authorization via child resources https://vulnerability.circl.lu/vuln/cve-2026-76215 <p><strong>Affected:</strong> thorsten phpMyFAQ</p> <p>phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.</p> <p><strong>Affected:</strong> thorsten phpMyFAQ</p> <p>phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.</p> https://vulnerability.circl.lu/vuln/cve-2026-76215