SQL Injection Vulnerability in phpMyFAQ Web Application
CVE-2026-34973

6.9MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
2 April 2026

What is CVE-2026-34973?

phpMyFAQ, an open-source FAQ web application, contains a vulnerability in the searchCustomPages() method, which fails to adequately sanitize input for SQL LIKE queries. The method uses real_escape_string() to escape search terms; however, it does not account for SQL LIKE metacharacters such as % and _. This oversight allows malicious actors to inject these wildcards, leading to unintended records being matched and potentially revealing sensitive information. The issue has been addressed in phpMyFAQ version 4.1.1, emphasizing the importance of keeping software up to date to mitigate such security risks.

Affected Version(s)

phpMyFAQ < 4.1.1

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
x_refsource_CONFIRM
https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.