CVE-2026-47132CWE-20CWE-200CWE-89sql-injectioninformation-disclosure

CVE-2026-47132

Medium · published September 24, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards. Version 4.2.0-alpha patches the issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-24T21:17Z
References (3)
https://github.com/thorsten/phpMyFAQ/commit/bd4b08b012234ccfcff07bfe6518062475b29e0a · [email protected]https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w · [email protected]https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 24 SEP 16:36Z
    phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
    cvelistv5