CVE-2026-85586CWE-799

CVE-2026-85586

published September 4, 2026

CVSS
6.9
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00359 · 29.0th percentile
Weakness
CWE-799 · Improper Control of Interaction Frequency
Published
2026-09-04T16:17Z
References (2)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-72vj-pvm4-mm7x · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-captcha-bypass-via-store-parameter · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:29Z
    phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
    cvelistv5