Resources Downloaded over Insecure Protocol

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol through the configuration API. An attacker can execute arbitrary PHP code by uploading a malicious ZIP file ...

CVE-2026-66398 phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...