{"id":"CVE-2026-109573","published":"2026-10-12T23:17:22.557","lastModified":"2026-10-13T14:17:27.180","description":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint","tags":[]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":[]}],"exploitRefs":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":[]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385","tags":[]}],"hasPoc":true,"ai":null}