CVE-2026-85586
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.
| CWE | CWE-799 |
| Vendor | thorsten |
| Product | phpmyfaq |
| Published | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for thorsten phpmyfaq
Be the first to know when new unknown vulnerabilities affecting thorsten phpmyfaq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
thorsten / phpMyFAQ
0 < 4.1.8
References
Credits
🔍 skeletonsec