CVE-2026-111901
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
| CWE | CWE-400 |
| Vendor | thorsten |
| Product | phpmyfaq |
| Published | Oct 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for thorsten phpmyfaq
Be the first to know when new high vulnerabilities affecting thorsten phpmyfaq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
thorsten / phpMyFAQ
4.2.0-alpha < 4.2.0-beta
References
Credits
🔍 R4yGM