Veille CVE

Dimanche 11 octobre 2026

1 CVE

Critique 0 Élevée 0 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « thorsten phpMyFAQ » ✕
  1. CVE-2026-108851 3.3 Faible

    thorsten phpMyFAQ

    phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.