CVE-2026-109573: phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

Q: Which deployments are exposed to exploitation?

phpMyFAQ deployments before 4.1.9 are exposed when their MySQL or MariaDB server uses NO_BACKSLASH_ESCAPES mode. The affected request path is the api/autocomplete search endpoint.

Q: Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can target the endpoint remotely, and no user interaction is required.

Q: What input is used to trigger the injection?

The attacker sends a Unicode right single quotation mark in the search parameter. It is normalized to an ASCII quote, while the application's backslash-based escaping is ineffective under NO_BACKSLASH_ESCAPES mode.

Q: What can an attacker do after successful exploitation?

The vulnerability can allow reading credentials and configuration secrets, modifying records, or dropping tables. This affects confidentiality, integrity, and availability.

Published Oct 12, 2026

Updated

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

Affected Software

1 affected component

PhpMyFaq phpmyfaq<4.1.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade phpMyFAQ to a version that resolves this vulnerability.
Fixed in 4.1.9

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to exploitation?

phpMyFAQ deployments before 4.1.9 are exposed when their MySQL or MariaDB server uses NO_BACKSLASH_ESCAPES mode. The affected request path is the api/autocomplete search endpoint.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can target the endpoint remotely, and no user interaction is required.

What input is used to trigger the injection?

The attacker sends a Unicode right single quotation mark in the search parameter. It is normalized to an ASCII quote, while the application's backslash-based escaping is ineffective under NO_BACKSLASH_ESCAPES mode.

What can an attacker do after successful exploitation?

The vulnerability can allow reading credentials and configuration secrets, modifying records, or dropping tables. This affects confidentiality, integrity, and availability.

CVE-2026-109573: phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to exploitation?

Does exploitation require authentication or user interaction?

What input is used to trigger the injection?

What can an attacker do after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to exploitation?

Does exploitation require authentication or user interaction?

What input is used to trigger the injection?

What can an attacker do after successful exploitation?