https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T08:45:10.318548+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-325848 EUVD-2026-325848 2026-10-05T08:45:10.379386+00:00 EUVD-2026-325848 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48488 fkie_cve-2026-48488 2026-10-05T08:45:10.379426+00:00

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-58fg-62fg-3fcj GHSA-58fg-62fg-3fcj — phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing 2026-10-05T08:45:10.379458+00:00

Affected: Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq

### Summary

Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).

### Details

**Affected File** : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php`

<img width="810" height="427" alt="image" src="https://github.com/user-attachments/assets/6499a008-3ece-4291-8296-f1d3303ba35c" />

### Impact

- An attacker can generate SHA-1 collisions to bypass attachment protection - Risk of password cracking if database is compromised - Estimated cracking time: < 1 minute for standard attachment

### Solution

**Use bcrypt:**

``` public function setPassword(string $password): void { $this->passwordHash = password_hash($password, PASSWORD_BCRYPT); }

public function verifyPassword(string $plainPassword): bool { return password_verify($plainPassword, $this->passwordHash); } ```