CyberRota Analysis
AI-GeneratedphpMyFAQ versions prior to 4.1.7 are vulnerable due to inadequate visibility checks on parent FAQs, allowing unauthenticated attackers to access restricted comments, email addresses, and attachment filenames through the comments and attachments API endpoints. This could lead to unauthorized information disclosure, potentially compromising user privacy. Organizations using affected versions should prioritize updating to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.
Related CVEs
Other vulnerabilities affecting the same vendor(s)