CVE-2026-56738

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6

Description An issue exists in the StopWords::add() function where user-supplied input is inserted into a SQL INSERT statement using sprintf() without proper database escaping. This occurs specifically in the code path used to add new stop words, whereas the StopWords::update() function correctly handles escaping. An authenticated administrator with access to the stop-word management feature can provide a crafted value via the word parameter to execute arbitrary SQL commands. This could allow an attacker to exfiltrate sensitive data, modify database rows, or delete tables.

Recommendations Update phpMyFAQ to version 4.1.6. As a temporary mitigation, restrict access to the stop-word management feature to only the most trusted administrators.