CVE-2026-35672

The record

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Affected packages

Related vulnerabilities

• GHSA-gp95-j463-vv28 phpMyFAQ: Default Empty API Token Authentication Bypass Same vulnerability
• CVE-2026-87827 Certain KGUARD DVR devices running vulnerable firmware expose a system command execution… CWE-1188
• CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1188
• CVE-2026-77348 Wallos is an open-source, self-hostable personal subscription tracker. CWE-1188
• CVE-2026-53507 oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post… CWE-1188
• CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in… CWE-1188
• CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-1188
• CVE-2026-62388 NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security… CWE-1188