Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-109573

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thorsten phpMyFAQ

Default version status: unaffected

  • 0 to < 4.1.9affected
  • 4.1.9unaffected
  • 4.2.0-alpha to < 4.2.0-betaaffected
  • 4.2.0-betaunaffected

References