CVE-2026-34973
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An information disclosure vulnerability was found in phpMyFAQ prior to version 4.1.1 in the searchCustomPages() method. The escape() function uses real_escape_string(), which does not escape LIKE metacharacters (% and _), allowing an unauthenticated attacker to inject these characters and read unintended records.
Risk Assessment
An unauthenticated attacker can read sensitive data that should not be exposed in search results.
Recommendation
Update phpMyFAQ to version 4.1.1 or later, which contains the fix.
Original NVD description (English source)
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure. This issue has been patched in version 4.1.1.