PT-2025-47176 · Phpmyfaq · Phpmyfaq

Published 2025-11-17 · Updated 2026-01-05 · CVE-2025-62519

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.0.14

Description phpMyFAQ is an open source FAQ web application. A privileged user with 'Configuration Edit' permissions can execute arbitrary SQL commands due to an authenticated SQL injection flaw in the main configuration update functionality. Successful exploitation could lead to a full compromise of the database, including the ability to read, modify, or delete all data, and potentially enable remote code execution depending on the database configuration.

Recommendations Update phpMyFAQ to version 4.0.14 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-62519

GHSA-FXM2-CMWJ-QVX4

Affected Products

Phpmyfaq

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62519.json · Exploit
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62519 · Security Note
• https://osv.dev/vulnerability/GHSA-fxm2-cmwj-qvx4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62519 · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14 · Note
• https://twitter.com/VulmonFeeds/status/1990534036465266716 · Twitter Post
• https://t.me/cveNotify/147753 · Telegram Post
• https://twitter.com/CVEnew/status/1990468944449118295 · Twitter Post
• https://t.me/CVEtracker/37517 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ozp1t6/resumen_diario_de_vulnerabilidades_17112025 · Reddit Post