CVE-2026-46366
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
phpMyFAQ before version 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering. This allows unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint.
Risk Assessment
Attackers can sequentially iterate solution IDs to discover all FAQs, including those restricted to specific users or groups. This may lead to the leakage of sensitive metadata.
Recommendation
It is recommended to update phpMyFAQ to version 4.1.2 or later to mitigate this vulnerability. Additionally, implementing proper permission filtering mechanisms in the application is advisable.
Other vulnerabilities in phpMyFAQ
See all- CVE-2026-56736High
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft.
- CVE-2026-57994Medium
A vulnerability in phpMyFAQ before version 4.1.5 allows unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content due to inconsistent filtering in public API endpoints.
- CVE-2026-57961Low
phpMyFAQ before version 4.1.5 contains a path traversal vulnerability in the concatenatePaths() function in Wrapper.php. An authenticated user with FAQ editing privileges can store crafted HTML with image paths that are processed during PDF generation. Lack of path canonicalization and root-directory containment validation may allow reading files outside the intended content directory.
- CVE-2017-15808High
In phpMyFaq before version 2.9.9, there is a CSRF vulnerability in admin/ajax.config.php.
- CVE-2017-15735High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability that allows modification of a glossary.
- CVE-2017-15734High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.main.php.
- CVE-2017-15733High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/ajax.attachment.php and admin/att.main.php.
- CVE-2017-15732High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/news.php.
- CVE-2017-15731High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.adminlog.php.
- CVE-2017-15730High
In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.ratings.php.
Original NVD description (English source)
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS