CVE-2026-109573
|
| |
|
|
Affected software |
MARIADB |
|
|
|
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-109573 |
