Veille CVE

Samedi 17 octobre 2026

1 CVE sur 28

Critique 1 Élevée 8 Moyenne 18 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « thorsten phpMyFAQ » ✕
  1. CVE-2026-111888 2.7 Faible

    thorsten phpMyFAQ

    phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.