exploitDog

CVE-2026-76215

Опубликовано: 19 авг. 2026

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Ссылки

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
Exploit
Mitigation
Vendor Advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources
Third Party Advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
Exploit
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*

Версия до 4.1.7 (исключая)

EPSS

Процентиль: 30%

0.00367

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-jqpp-mfm2-hfw2

CVSS3: 5.3

github

около 1 месяца назад

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

EPSS

Процентиль: 30%

0.00367

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-862