PhpMyFAQ Has A LIKE Wildcard Injection In Search.php — Unescaped % And _ Metacharacters Enable Broad Content Disclosure

Summary The "searchCustomPages" method in "phpmyfaq/src/phpMyFAQ/Search.php" uses "realescapestring" via "escape" to sanitize the search term before embedding it in LIKE clauses. However, "realescapestring" does not escape SQL LIKE metacharacters "%" match any sequence and "" match any single...

CVE-2026-34973

CVE-2026-34973 affects phpMyFAQ prior to 4.1.1. The bug is in the searchCustomPages() function where real_escape_string() (via escape()) sanitizes the search term for LIKE clauses but does not escape SQL LIKE metacharacters % and _. Consequently, an unauthenticated attacker can inject wildcards i...

CVE-2026-34973 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE...

GHSA-GCP9-5JC8-976X phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

Summary The searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE metacharacters % match any sequence and match any single character. An...

CVE-2026-25591

Summary of CVE-2026-25591 (from connected advisory): A SQL LIKE wildcard injection in the authenticated endpoint /api/token/search allows crafted patterns to cause resource exhaustion and DoS by forcing expensive queries. The vulnerable code directly concatenates user-supplied keyword and token i...

GHSA-W6X6-9FP7-FQM4 New API has an SQL LIKE Wildcard Injection DoS via Token Search

Summary A SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause Denial of Service through resource exhaustion by crafting malicious search patterns. Details The token search endpoint accepts user-supplied keyword and token parameters that...