Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

phpMyFAQ lets config editors execute database commands

CVE-2025-62519 · published 11 months ago
Summary

In phpMyFAQ versions before 4.0.14, a user who can edit the configuration can insert malicious data that runs arbitrary database queries. This could let an attacker read, change, or delete all stored information and possibly run code on the server. Upgrade to version 4.0.14 or later to fix it.

What to do
  • Update thorsten phpmyfaq to version 4.0.14.
  • Update phpmyfaq phpmyfaq to version 4.0.14.
Affected software
Ecosystem VendorProductAffected versions
composer thorsten phpmyfaq <= 4.0.13
Fix: upgrade to 4.0.14
composer phpmyfaq phpmyfaq <= 4.0.13
Fix: upgrade to 4.0.14
– phpmyfaq phpmyfaq < 4.0.14
cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
Original advisory text
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published17 Nov 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fxm2-cmwj-qvx4 · GHSA
CVE-2025-62519 · NVD
CVE-2025-62519 · OSV
Track software like this
Free during beta