SQL Injection Vulnerability in phpMyFAQ by phpMyFAQ Team

CVE-2026-76205

What is CVE-2026-76205?

A SQL injection vulnerability exists in phpMyFAQ before version 4.1.7, specifically within the glossary create and update endpoints. This issue arises due to the improper handling of escaped strings, allowing authenticated users with permissions to add or edit glossary entries to exploit the vulnerability. By crafting a malicious payload that involves a dangling backslash, they can manipulate SQL statements, potentially leading to unauthorized access to sensitive database information.

References