CVE-2026-109573High· 8.1▾ MidnightPoC available

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score57/ 100 · Moderate

impact 44.6 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Oct 12, 2026

Updated

Oct 13, 2026

CVSS

8.1

Vendor

thorsten

Product

phpMyFAQ

CWE

CWE-89

Depth score

57 · Moderate

EPSS

0.34% · p27

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-13

Exploitation: poc
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 13.

0.3% → 0.3%▲ 0.08%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 14 days

Oct 12, 2026Published
Disclosed via NVD
Oct 13, 2026Record revised
Last analysed / modified upstream
Oct 13, 2026EPSS first tracked
0.3%
Oct 15, 2026Public exploit observed
Exploit / PoC code exists
Oct 26, 2026EPSS peak
0.3% → 0.3%

thorsten CWE-89 #nvd #cve.org #exploit-available

Affected

phpMyFAQ < 4.1.9
phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta

Full technical detail▾

Overview

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 15, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available

← Back to feed