An authenticated administrator can supply an untrusted
update-package path to the configuration API, causing phpMyFAQ
to write an arbitrary PHP file to the server and thereby
execute attacker-controlled code.
An attacker can exploit a path traversal in the category image
deletion routine to remove arbitrary files outside the intended
directory, which can leave the installation in a state that
allows a setup takeover.
The two-factor authentication login flow can be completed
without verifying the password factor, so an attacker who
possesses only the second factor is able to authenticate as the
victim.
A delegated administrator with only the GROUP_EDIT permission
can assign group memberships without restriction through
GroupController::updateMembers, inheriting rights they do not
hold and escalating their privileges.
An authenticated user can inject SQL through an unescaped stop
word inserted via StopWords::add(), allowing manipulation of the
underlying database query.