CVE-2026-56738High· 8.5▾ TwilightphpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string withou…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
phpMyFAQ is an open source FAQ web application. The StopWords::add() method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf() and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update(), which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the add() (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the "word" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
phpmyfaq/phpmyfaq <= 4.1.5thorsten/phpmyfaq <= 4.1.5Patched in:
phpmyfaq/phpmyfaq 4.1.6thorsten/phpmyfaq 4.1.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56737High· 8.1phpMyFAQ is an open source FAQ web application
CVE-2026-109573High· 8.1phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode
CVE-2025-62519High· 7.2phpMyFAQ is an open source FAQ web application
CVE-2026-56736High· 8.2phpMyFAQ is an open source FAQ web application
CVE-2026-47132Medium· 5.4phpMyFAQ is an open source FAQ web application
CVE-2026-116182Medium· 5.0phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching