PT-2026-29784 · Phpmyfaq · Phpmyfaq

Athuljayaram · Published 2026-04-01 · Updated 2026-04-02 · CVE-2026-34973

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.1

Description pMyFAQ is an open source FAQ web application. The searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real escape string() to sanitize search terms before embedding them in LIKE clauses. However, real escape string() does not escape SQL LIKE metacharacters % (match any sequence) and (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records, resulting in information disclosure. The vulnerable code is located in phpmyfaq/src/phpMyFAQ/Search.php, lines 226–240. The attack vector involves submitting a search term containing or % as part of a word with a length of 3 or more characters, bypassing a length filter. For example, a search for % can match all custom pages. This allows an attacker to retrieve custom page content that would not appear in normal searches.

Recommendations Update phpMyFAQ to version 4.1.1 or later.

Fix

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-34973

GHSA-GCP9-5JC8-976X

Affected Products

Phpmyfaq

References · 6

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gcp9-5jc8-976x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34973 · Security Note
• https://osv.dev/vulnerability/GHSA-gcp9-5jc8-976x · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 · Note
• https://twitter.com/CVEnew/status/2039744290323108296 · Twitter Post