CVE-2026-85586
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| thorsten | phpMyFAQ | 0 < 4.1.8 | affected |
| thorsten | phpMyFAQ | 4.1.8 | unaffected |
Weaknesses
- CWE-799: Improper Control of Interaction Frequency
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-72vj-pvm4-mm7x
- https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-captcha-bypass-via-store-parameter
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.