CVE-2026-76205 in PhpMyfaq
要約
〜によって MITRE • 2026年08月19日
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.