CRITICAL 9.2 NVD
CVE-2026-109573
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally whe
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385
- https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocompl
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-12 via NVD.
Risk Timeline
CVE Disclosed2026-10-12 · 0 days ago
Remediation Resources
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.