CVEvulnerability

CVE-2026-85586

6.9 MEDIUM Published 2026-09-04 Modified 2026-09-10 Official page ↗
Status
Deferred
Published
2026-09-04
Last modified
2026-09-10
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-799

Description

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

Related

Weakness · CWE (1)

  • CWE-799 Improper Control of Interaction Frequency weakness

References