CVE-2026-85586: fallo de gravedad media en thorsten phpMyFAQ
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.5%
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
thorsten · phpMyFAQCVEs relacionadas — thorsten phpMyFAQ
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-55889MEDIUMphpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded FramesEPSS 2.2%CVE-2025-69200HIGHphpMyFAQ has unauthenticated config backup download via /api/setup/backupEPSS 2.1%CVE-2026-24421MEDIUMphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userEPSS 1.7%CVE-2024-28105HIGHphpMyFAQ's File Upload Bypass at Category Image Leads to RCEEPSS 1.5%CVE-2024-27299HIGHphpMyFAQ SQL Injection at "Save News"EPSS 1.2%CVE-2024-28107HIGHphpMyFAQ SQL injections at insertentry & saveentryEPSS 1.0%