https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:24:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322439 EUVD-2026-322439 https://cve.radiocsirt.org/vuln/euvd-2026-322439 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46366 <p>phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.</p> <p>phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46366 https://cve.radiocsirt.org/vuln/ghsa-99qv-g4x9-mgc3 <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>## Summary</p> <p>The public `/solution_id_{id}.html` route calls `Faq::getIdFromSolutionId()` in `phpmyfaq/src/phpMyFAQ/Faq.php:1312`. That query joins `faqdata` with `faqcategoryrelations` solely by `solution_id` and returns the matching FAQ&#39;s `id`, `lang`, `thema` (title), and `category_id` with no permission filter. An unauthenticated visitor hits the route with a sequential integer and the server 301-redirects to `/content/&lt;category&gt;/&lt;id&gt;/&lt;lang&gt;/&lt;title-slug&gt;.html`, leaking the FAQ&#39;s existence, internal id, language, category binding, and title via the redirect&#39;s `Location` header and the redirected page&#39;s canonical link, share-to-social URLs, and hidden form fields. The related `getFaqBySolutionId()` at line 1221 contains an explicit fallback query (added &#34;for tests&#34;) that also bypasses the permission filter, widening the blast radius to any callsite that trusts its result.</p> <p>## Details</p> <p>### The sink: `getIdFromSolutionId()` has no permission filter</p> <p>`phpmyfaq/src/phpMyFAQ/Faq.php:1312`:</p> <p>```php public function getIdFromSolutionId(int $solutionId): array { $query = sprintf( &#39;SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id FROM %sfaqdata fd LEFT JOIN %sfaqcategoryrelations fcr ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang WHERE fd.solution_id = %d&#39;, Database::getTablePrefix(), Database::getTablePrefix(), $solutionId, ); // ... } ```</p> <p>No `WHERE`-clause permission f…</p> <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq, Packagist: phpmyfaq/phpmyfaq</p> <p>## Summary</p> <p>The public `/solution_id_{id}.html` route calls `Faq::getIdFromSolutionId()` in `phpmyfaq/src/phpMyFAQ/Faq.php:1312`. That query joins `faqdata` with `faqcategoryrelations` solely by `solution_id` and returns the matching FAQ&#39;s `id`, `lang`, `thema` (title), and `category_id` with no permission filter. An unauthenticated visitor hits the route with a sequential integer and the server 301-redirects to `/content/&lt;category&gt;/&lt;id&gt;/&lt;lang&gt;/&lt;title-slug&gt;.html`, leaking the FAQ&#39;s existence, internal id, language, category binding, and title via the redirect&#39;s `Location` header and the redirected page&#39;s canonical link, share-to-social URLs, and hidden form fields. The related `getFaqBySolutionId()` at line 1221 contains an explicit fallback query (added &#34;for tests&#34;) that also bypasses the permission filter, widening the blast radius to any callsite that trusts its result.</p> <p>## Details</p> <p>### The sink: `getIdFromSolutionId()` has no permission filter</p> <p>`phpmyfaq/src/phpMyFAQ/Faq.php:1312`:</p> <p>```php public function getIdFromSolutionId(int $solutionId): array { $query = sprintf( &#39;SELECT fd.id, fd.lang, fd.thema AS question, fd.content, fcr.category_id FROM %sfaqdata fd LEFT JOIN %sfaqcategoryrelations fcr ON fd.id = fcr.record_id AND fd.lang = fcr.record_lang WHERE fd.solution_id = %d&#39;, Database::getTablePrefix(), Database::getTablePrefix(), $solutionId, ); // ... } ```</p> <p>No `WHERE`-clause permission f…</p> https://cve.radiocsirt.org/vuln/ghsa-99qv-g4x9-mgc3