CVE-2026-35672 | BDVDB-2026-336133 Detail
thorstenphpMyFAQ
Description#
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-1188 Initialization of a Resource with an Insecure Default
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.