https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:13:33.019761+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12610 bdu:2026-12610 2026-10-04T03:13:33.022393+00:00 bdu:2026-12610 https://cve.radiocsirt.org/vuln/euvd-2026-356720 EUVD-2026-356720 2026-10-04T03:13:33.022425+00:00 EUVD-2026-356720 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75920 fkie_cve-2026-75920 2026-10-04T03:13:33.022439+00:00

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

 https://cve.radiocsirt.org/vuln/ghsa-2mwq-hcmq-fqq4 GHSA-2mwq-hcmq-fqq4 2026-10-04T03:13:33.022468+00:00

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.