CVE-2026-76205: phpMyFAQ before 4.1.7 SQL Injection via Glossary

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-19 · updated 2026-09-01
Weakness: CWE-89

Description

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.

Affected products

thorsten phpMyFAQ: before 4.1.7 — fixed in 4.1.7

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.7. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-79h3-6hxj-g98h
https://www.vulncheck.com/advisories/phpmyfaq-before-sql-injection-via-glossary
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-79h3-6hxj-g98h

Get alerted when CVE-2026-76205 or the next vulnerability affects your stack