CVE-2026-85589: falha de média gravidade em thorsten phpMyFAQ
phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and content-health counters regardless of their privilege level.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
thorsten · phpMyFAQCVEs relacionadas — thorsten phpMyFAQ
No mesmo produto, das mais perigosas para as menos.
CVE-2024-55889MEDIUMphpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded FramesEPSS 2.2%CVE-2025-69200HIGHphpMyFAQ has unauthenticated config backup download via /api/setup/backupEPSS 2.1%CVE-2026-24421MEDIUMphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userEPSS 1.7%CVE-2024-28105HIGHphpMyFAQ's File Upload Bypass at Category Image Leads to RCEEPSS 1.5%CVE-2024-27299HIGHphpMyFAQ SQL Injection at "Save News"EPSS 1.2%CVE-2024-28107HIGHphpMyFAQ SQL injections at insertentry & saveentryEPSS 1.0%