EUVD-2026-32905
GHSA-9qv9-8xv6-5p35
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.
AnalysisAI
Unauthenticated account takeover in phpMyFAQ before 4.1.3 allows remote attackers to forcibly reset any user's password by sending a PUT request to the /api/index.php/user/password/update endpoint with a valid username and email pair. The endpoint also leaks valid credentials through response code differentials (200 vs 409), enabling username/email enumeration before the reset. No public exploit identified at time of analysis, though a detailed PoC is published in the GHSA advisory.
Technical ContextAI
phpMyFAQ is a PHP-based open-source FAQ management system (CPE cpe:2.3:a:thorsten:phpmyfaq) maintained by Thorsten Rinne. The vulnerable code path lives in phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php, where the route 'user/password/update' is intentionally exposed without authentication to support the 'forgot password' workflow. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) is the root cause: the controller treats a username+email match as sufficient proof of ownership, then calls createPassword() and changePassword() immediately - bypassing the standard out-of-band token/email-confirmation pattern. The mailbox is only used after the password has already been rotated, so possession of the email account is never verified.
RemediationAI
Vendor-released patch: upgrade phpMyFAQ to 4.1.3 or later, which adds proper token-based reset confirmation; install via Composer (composer require thorsten/phpmyfaq:^4.1.3) per the GHSA advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35. If immediate patching is not possible, block external access to the /api/index.php/user/password/update route at the reverse proxy or WAF (e.g., deny PUT requests to that path from untrusted networks), accepting that this disables the in-product password-reset workflow until users are migrated. As a complementary control, monitor web access logs for PUT requests to that endpoint and force a password rotation plus session invalidation for any users whose accounts received unsolicited reset emails, since exploitation leaves the new password sitting in mail logs.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today