Skip to content
Threat Feed
Subscribe

Product

PhpMyFAQ (3.2.0-Alpha to < 4.1.9)

1 brief RSS
critical advisory

SQL Injection in phpMyFAQ via PdoMysql::escape()

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

phpMyFAQ +4 web-application sql-injection cve authentication-bypass sso cve-2026-111882 web-application-vulnerability authorization-bypass +2
6t 1c updated