CVE-2026-47132Medium· 5.4▾ TwilightPoC availablephpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.3%
phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and _, which remain active LIKE wildcards. Version 4.2.0-alpha patches the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
thorsten/phpmyfaq < 4.2.0-alphaPatched in:
thorsten/phpmyfaq 4.2.0-alphaField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-mf8r-wm2w-f8c5Medium· 5.3phpMyFAQ public FAQ APIs expose inactive FAQ content
CVE-2026-111904Medium· 5.3phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
CVE-2026-109573High· 8.1phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode
CVE-2026-56738High· 8.5phpMyFAQ is an open source FAQ web application
CVE-2026-56737High· 8.1phpMyFAQ is an open source FAQ web application
CVE-2026-56736High· 8.2phpMyFAQ is an open source FAQ web application