SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-85586

MEDIUM · CVSS 6.9 EPSS 0.36% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Versions of phpMyFAQ prior to 4.1.8 are vulnerable due to inadequate CAPTCHA validation when the store parameter is set to 'now' during question submissions. This flaw allows unauthenticated attackers to bypass CAPTCHA protections, leading to potential database pollution and excessive outgoing mail notifications. Organizations using affected versions should prioritize patching to mitigate the risk of abuse and service disruption.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-85586
Severity
MEDIUM
CVSS
6.9
EPSS
0.36%

Original NVD Description

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.