CVE-2026-76205 — phpMyFAQ before 4.1.7 SQL Injection via Glossary
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL lite…
Published: 2026-08-19 · CVSS: 8.6 · CVSS 4.0
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7