CVE-2026-47132

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-47132

The open source FAQ web application phpMyFAQ (prior to version 4.2.0-alpha ) is vulnerable to an SQL LIKE wildcard injection in its chat user search endpoint. The application fails to escape the % and _ characters in the q parameter of the GET /api/chat/users?q=... endpoint. While the system uses...

CVE-2026-47132 phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

EUVD-2026-86290

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

CVE-2026-78691

ash_sql (an Elixir query library from the Ash ecosystem) is vulnerable to LIKE wildcard injection in its contains/2, string_starts_with/2, and string_ends_with/2 filters. The escape helpers prefix % and _ with a backslash but fail to escape a pre-existing backslash in user input, so \% becomes a ...

EEF-CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

PT-2026-83546

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash sql allows a user who supplies a search term to contains/2, string starts with/2, or string ends with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlle...

CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

CVE-2026-76212 phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

PhpMyFAQ Has A LIKE Wildcard Injection In Search.php — Unescaped % And _ Metacharacters Enable Broad Content Disclosure

Summary The "searchCustomPages" method in "phpmyfaq/src/phpMyFAQ/Search.php" uses "realescapestring" via "escape" to sanitize the search term before embedding it in LIKE clauses. However, "realescapestring" does not escape SQL LIKE metacharacters "%" match any sequence and "" match any single...

CVE-2026-34973 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE...

CVE-2026-34973 phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE...

CVE-2026-34973

CVE-2026-34973 affects phpMyFAQ prior to 4.1.1. The bug is in the searchCustomPages() function where real_escape_string() (via escape()) sanitizes the search term for LIKE clauses but does not escape SQL LIKE metacharacters % and _. Consequently, an unauthenticated attacker can inject wildcards i...

GHSA-GCP9-5JC8-976X phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure

Summary The searchCustomPages method in phpmyfaq/src/phpMyFAQ/Search.php uses realescapestring via escape to sanitize the search term before embedding it in LIKE clauses. However, realescapestring does not escape SQL LIKE metacharacters % match any sequence and match any single character. An...

CVE-2026-25591

Summary of CVE-2026-25591 (from connected advisory): A SQL LIKE wildcard injection in the authenticated endpoint /api/token/search allows crafted patterns to cause resource exhaustion and DoS by forcing expensive queries. The vulnerable code directly concatenates user-supplied keyword and token i...

CVE-2026-25591: Improper Neutralization of Special Elements in Data Query Logic

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by...

GHSA-W6X6-9FP7-FQM4 New API has an SQL LIKE Wildcard Injection DoS via Token Search

Summary A SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause Denial of Service through resource exhaustion by crafting malicious search patterns. Details The token search endpoint accepts user-supplied keyword and token parameters that...