CVE-2026-111901: phpMyFAQ 4.2.0-alpha to before 4.2.0-beta

Affected technology

phpMyFAQ · 4.2.0-alpha to before 4.2.0-beta
thorsten

Description’s affected range: before 4.2.0-beta

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.