CyberRota Analysis
AI-GeneratedVersions of phpMyFAQ prior to 4.1.7 are vulnerable due to inadequate validation of active status in the PDF export endpoint, enabling unauthenticated attackers to extract metadata from draft FAQs. This flaw allows attackers to access sensitive information, such as titles, solution IDs, author names, and last-update timestamps of unpublished content. Organizations using affected versions should prioritize patching to mitigate the risk of exposing internal knowledge base information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.
Related CVEs
Other vulnerabilities affecting the same vendor(s)