Vulnerability · Published Nov 17, 2025 · Assigned by GitHub_M
CVE-2025-62519phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
High 7.2
In plain English
A high-severity SQL injection in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 4.0.14 | GHSA-fxm2-cmwj-qvx4 |
| Packagist | thorsten/phpmyfaq | 4.0.14 | GHSA-fxm2-cmwj-qvx4 |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fxm2-cmwj-qvx4 x_refsource_CONFIRM
- https://github.com/thorsten/phpMyFAQ/compare/4.0.13...4.0.14 x_refsource_MISC