How many CVEs have a located fix in thorsten/phpmyfaq?

106 published CVEs have a fix traced to functions in thorsten/phpmyfaq, touching 135 functions across 139 files.

Which function in thorsten/phpmyfaq has been patched by the most CVEs?

ajax in phpmyfaq/admin/assets/js/tags.js has been changed by 3 CVE fixes, from 2017 to 2023.

How large is a typical CVE fix in thorsten/phpmyfaq?

The median fix changes 12 lines. 71% of fixes change 20 lines or fewer, and 37% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

javascript

#32 of 500 repositories

thorsten/phpmyfaq

Name: thorsten/phpmyfaq: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 24, 2026

106

CVE fixes located

Published CVEs

135

Functions patched

Distinct function sites

139

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

106 published CVEs have a fix traced to functions in thorsten/phpmyfaq, the earliest published in 2017. Those fixes changed 135 distinct functions across 139 files, in 817 patch hunks.

Among the 500 repositories tracked here, thorsten/phpmyfaq ranks #32 by the number of CVEs with a located fix.

Most patched functions

Functions in thorsten/phpmyfaq changed by the most CVE fixes.

Most patched files

Files in thorsten/phpmyfaq changed by the most CVE fixes.

1phpmyfaq/ajaxservice.php10 CVEs · 0 functions
2phpmyfaq/admin/user.php7 CVEs · 0 functions
3phpmyfaq/index.php7 CVEs · 0 functions
4phpmyfaq/src/phpMyFAQ/Faq.php6 CVEs · 8 functions
5phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php5 CVEs · 2 functions
6phpmyfaq/admin/configuration.php5 CVEs · 1 functions
7phpmyfaq/src/phpMyFAQ/News.php4 CVEs · 4 functions
8phpmyfaq/admin/ajax.user.php4 CVEs · 0 functions
9phpmyfaq/admin/record.edit.php4 CVEs · 0 functions
10phpmyfaq/api.service.php4 CVEs · 0 functions

Fix size

How much code a CVE fix in thorsten/phpmyfaq changes, with backports counted once.

12

Median lines changed

Added plus removed, per CVE

71%

Fixes of 20 lines or fewer

Share of CVE fixes

37%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in thorsten/phpmyfaq, and the functions each fix changed.

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
CVE-2026-47132searchUsers
Medium · CVSS 5.4
EPSS 0.3%2026-09-24
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
CVE-2026-56738add
High · CVSS 8.5
EPSS 0.3%2026-09-24
phpMyFAQ's two-factor authentication login bypasses the password factor
CVE-2026-56737login check authenticate
High · CVSS 8.1
EPSS 0.4%2026-09-24
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
CVE-2026-56736create
High · CVSS 8.2
EPSS 0.2%2026-09-24
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
CVE-2026-49205create update
Medium · CVSS 6.5
EPSS 0.4%2026-06-18
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
CVE-2026-48488setKey getMeta saveMeta
Low · CVSS 2.7
EPSS 0.3%2026-06-08
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
CVE-2026-46364parseHtaccess adjustRewriteBaseHtaccess getRewriteBase
Critical · CVSS 9.3
EPSS 2.1%2026-05-15
phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
CVE-2026-27836prepare
High · CVSS 7.5
EPSS 0.5%2026-02-27
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
CVE-2025-69200
High · CVSS 7.5
EPSS 2.1%2025-12-29
phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw
CVE-2025-68951
Medium · CVSS 6.1
EPSS 0.3%2025-12-29
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
CVE-2025-62519setEmailTo get addEmailTo
High · CVSS 7.2
EPSS 0.7%2025-11-17
phpMyFAQ duplicate email registration allows multiple accounts with the same email
CVE-2025-59943createUser emailExists isEmailAddress
Critical · CVSS 9.8
EPSS 0.4%2025-10-03

Get an alert for each new thorsten/phpmyfaq CVE, with the patched functions and AI-written analysis.

Monitor phpmyfaq CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

InternationalColorConsortium/iccDEV104 CVEs craftcms/cms103 CVEs mantisbt/mantisbt103 CVEs openssl/openssl101 CVEs radareorg/radare2101 CVEs nextcloud/server112 CVEs keycloak/keycloak114 CVEs wolfSSL/wolfssl114 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in thorsten/phpmyfaq.

How many CVEs have a located fix in thorsten/phpmyfaq?: 106 published CVEs have a fix traced to functions in thorsten/phpmyfaq, touching 135 functions across 139 files.
Which function in thorsten/phpmyfaq has been patched by the most CVEs?: ajax in phpmyfaq/admin/assets/js/tags.js has been changed by 3 CVE fixes, from 2017 to 2023.
How large is a typical CVE fix in thorsten/phpmyfaq?: The median fix changes 12 lines. 71% of fixes change 20 lines or fewer, and 37% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track thorsten/phpmyfaq CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing