CVE-2026-76205

phpMyFAQ before 4.1.7 contains an SQL injection flaw (CWE-89) in the glossary create and update endpoints, caused by truncating an escaped string before it is embedded in a SQL literal. An authenticated user holding glossary add or edit permissions can craft a payload with a dangling backslash that escapes the closing quote of the SQL literal, allowing injection of arbitrary SQL commands. A successful attacker can execute arbitrary SQL against the backend database and read sensitive database information, and the 8.6 (high) CVSS 4.0 score reflects high confidentiality and integrity impact with low required privileges and no user interaction. Any phpMyFAQ deployment running a version earlier than 4.1.7 is affected, and the most plausible targets are internet-exposed instances where accounts with glossary add or edit rights exist. The flaw is documented in a public vendor advisory (GHSA-79h3-6hxj-g98h) with a public reference, it is not in CISA's KEV catalog, and its EPSS of 0.3% (21st percentile) indicates low predicted near-term exploitation with no confirmed in-the-wild exploitation in the available data.

What to do: Upgrade phpMyFAQ to version 4.1.7 or later, which fixes the escaped-string truncation in the glossary create and update endpoints. Until patched, restrict glossary add/edit permissions to trusted accounts and check whether any lower-trust or recently created users hold those rights, since exploitation requires an authenticated session. Review database and application logs for anomalous SQL activity, and prioritize patching any internet-exposed phpMyFAQ instances.