phpMyFAQ CVE-2026-111901

Exploitation requires a network-reachable phpMyFAQ 4.2.0-alpha instance with the unauthenticated faqs and search API endpoints accessible (their default unauthenticated state is the core enabling condition). The attacker must be able to issue many concurrent GET requests; effectiveness scales with the number of database records, since each request loads all records into PHP memory. Limiting factors: only the 4.2.0-alpha pre-release line before 4.2.0-beta is affected, so stable-release and patched (4.2.0-beta+) deployments are not exploitable; impact is confined to availability with no data exposure or code execution, and upstream rate-limiting, a WAF, or reverse-proxy connection throttling in front of the application would blunt the concurrent-request flood.

Signals align consistently toward a genuine but bounded availability risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remotely reachable, low-complexity, unauthenticated attack path, and the impact profile is availability-only (VA:H; VC:N/VI:N), matching the CWE-400 uncontrolled resource consumption classification and the description's crash-the-server outcome. No EPSS score, CISA KEV listing, or SSVC decision record was provided in the input, and no public exploit is referenced, so exploitation-probability and automatability signals are absent rather than low - they are simply unavailable. There is no conflict between the CVSS vector and the description: both indicate unauthenticated network access to the faqs and search API endpoints with no special privileges. The practical priority is moderate: this is a denial-of-service issue with no confidentiality or integrity impact, affecting only pre-release 4.2.0-alpha builds, so it is a real but availability-scoped concern rather than a widespread remote-code-execution emergency. EPSS and KEV data being missing means the 8.7 score should not alone drive emergency patching absent evidence of active targeting.

An attacker, without any credentials, scripts a client to issue many concurrent GET requests to the unauthenticated faqs and search API endpoints of an exposed phpMyFAQ 4.2.0-alpha instance. Each request forces the application to load and process every database record into PHP memory, and the parallel load exhausts CPU and memory until the server becomes unresponsive. No public proof-of-concept is referenced, but the attack requires only a basic HTTP flooding script.