Skip to content
Threat Feed
Subscribe

Product

PhpMyFAQ (< 4.1.9, 4.2.0-Alpha Before 4.2.0-Beta)

1 brief RSS
critical advisory

SQL Injection in phpMyFAQ via PdoMysql::escape()

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

phpMyFAQ +4 web-application sql-injection cve authentication-bypass sso cve-2026-111882 web-application-vulnerability authorization-bypass +2
6t 1c updated