All vulnerabilities
CVE-2026-111907GHSA-6x9g-rfx8-g42q

phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

thorsten phpMyFAQ
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.9Fixed versionCVE List
Published17 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

Text from CVE List

Affected versions 2

  • phpMyFAQaffected: 4.0.0 before 4.1.9CVE List
  • phpMyFAQunaffected: 4.1.9CVE List

References 2