8 matches found
EUVD-2026-98156
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
CVE-2026-109573
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
CVE-2026-109573
Versions of phpMyFAQ prior to 4.1.9 are vulnerable to an SQL injection via the api/autocomplete search endpoint. The root cause lies in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB operate in NO_BACKSLASH_ESCAPES mode. Unauthent...
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
CVE-2026-109573: Improper Neutralization of Special Elements used in an SQL Command
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...
PT-2026-111012
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 Description An SQL injection issue exists in the PdoMysql::escape function. When MySQL or MariaDB is configured in NO BACKSLASH ESCAPES mode, single quotes are escaped with backslashes that the database treats ...