Veille CVE

Mardi 13 octobre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « thorsten phpMyFAQ » ✕
  1. CVE-2026-109573 8.1 Élevée

    thorsten phpMyFAQ

    phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

  2. CVE-2026-108851 3.3 Faible

    thorsten phpMyFAQ

    phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.