CVE-2026-75918

HighCVSS 8.8/10Last modified Sep 1, 2026

Description

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
thorsten	phpMyFAQ	< 4.1.7

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7xExploit, Vendor Advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-tracking-fileThird Party Advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7xExploit, Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-759195.3phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run databa CVE-2026-75927.3A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. CVE-2026-759205.3phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files inclu CVE-2026-759217.2The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for Wor CVE-2026-759225.3Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream CVE-2026-759248.7A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read CVE-2026-759259.6Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. CVE-2026-759268.6Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS CVE-2026-759277.2The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to P CVE-2026-759285.3The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allo CVE-2026-75937.3A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_com CVE-2026-759304.3The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in