CVE-2026-111907

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

EUVD-2026-103313

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-111907

The software phpMyFAQ versions 4.0.0 before 4.1.9 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the POST /admin/api/update-database endpoint. The root cause is the lack of CSRF token validation when executing database migrations. An attacker can trick a logged-in user poss...

CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...