CVE-2026-76205: Phpmyfaq

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.

Affected products

• Phpmyfaq Phpmyfaq: before 4.1.7 (fixed in 4.1.7)

Published 2026-08-19. Last modified 2026-09-01.