Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck
CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
High 7.5
In plain English
A high-severity uncontrolled resource consumption in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-m42f-6p37-2c79) vendor-advisory
- VulnCheck Advisory: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination third-party-advisory