CVE-2026-109573 — phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaD…
Published: 2026-10-12 · CVSS: 9.2 · CVSS 4.0
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7