https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:19:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329550 EUVD-2026-329550 https://cve.radiocsirt.org/vuln/euvd-2026-329550 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35675 <p>phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.</p> <p>phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35675 https://cve.radiocsirt.org/vuln/ghsa-w9xh-5f39-vq89 <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>### Summary An authentication bypass vulnerability in phpMyFAQ allows any unauthenticated attacker to reset the password of any user account, including SuperAdmin accounts. By sending a PUT request with just a valid username and associated email address to /api/user/password/update, an attacker receives a new plaintext password via email without any token verification, rate limiting, or email confirmation. This enables complete account takeover of any user, including full administrative access.</p> <p>### Details File: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php Lines: 56-130 The updatePassword() method at line 56 accepts PUT requests to /user/password/update with only username and email in the JSON body: #[Route(path: &#39;user/password/update&#39;, name: &#39;api.private.user.password&#39;, methods: [&#39;PUT&#39;])] ```php public function updatePassword(Request $request): JsonResponse { $data = json_decode($request-&gt;getContent()); $username = trim((string) Filter::filterVar($data-&gt;username, FILTER_SANITIZE_SPECIAL_CHARS)); $email = trim((string) Filter::filterEmail($data-&gt;email)); if ($username !== &#39;&#39; &amp;&amp; $username !== &#39;0&#39; &amp;&amp; ($email !== &#39;&#39; &amp;&amp; $email !== &#39;0&#39;)) { $user = ($this-&gt;currentUserFactory ?? CurrentUser::getCurrentUser(...))($this-&gt;configuration); $loginExist = $user-&gt;getUserByLogin($username); if ($loginExist &amp;&amp; $email === $user-&gt;getUserData(&#39;email&#39;)) { // NO TOKEN CHECK // NO RATE LIMITING…</p> <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>### Summary An authentication bypass vulnerability in phpMyFAQ allows any unauthenticated attacker to reset the password of any user account, including SuperAdmin accounts. By sending a PUT request with just a valid username and associated email address to /api/user/password/update, an attacker receives a new plaintext password via email without any token verification, rate limiting, or email confirmation. This enables complete account takeover of any user, including full administrative access.</p> <p>### Details File: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php Lines: 56-130 The updatePassword() method at line 56 accepts PUT requests to /user/password/update with only username and email in the JSON body: #[Route(path: &#39;user/password/update&#39;, name: &#39;api.private.user.password&#39;, methods: [&#39;PUT&#39;])] ```php public function updatePassword(Request $request): JsonResponse { $data = json_decode($request-&gt;getContent()); $username = trim((string) Filter::filterVar($data-&gt;username, FILTER_SANITIZE_SPECIAL_CHARS)); $email = trim((string) Filter::filterEmail($data-&gt;email)); if ($username !== &#39;&#39; &amp;&amp; $username !== &#39;0&#39; &amp;&amp; ($email !== &#39;&#39; &amp;&amp; $email !== &#39;0&#39;)) { $user = ($this-&gt;currentUserFactory ?? CurrentUser::getCurrentUser(...))($this-&gt;configuration); $loginExist = $user-&gt;getUserByLogin($username); if ($loginExist &amp;&amp; $email === $user-&gt;getUserData(&#39;email&#39;)) { // NO TOKEN CHECK // NO RATE LIMITING…</p> https://cve.radiocsirt.org/vuln/ghsa-w9xh-5f39-vq89