CVE-2026-76205
HighCVSS 8.1Summary
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.
Risk Assessment
Risk of sensitive data leakage from the database, potentially leading to confidentiality and integrity breaches.
Recommendation
Update phpMyFAQ to version 4.1.7 or later. Restrict glossary permissions and monitor SQL queries for unusual patterns.
Original NVD description (English source)
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.