CVE-2025-59943

Katalog CVE

CVSS 9.8 · Critical EPSS 0,42%

Kerentanan Improper Access Control pada phpmyfaq. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.

Rincian

Terbit di NVD

3 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-286: Incorrect User Management

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9wj2-4hcm-r74j exploit · advisory vendor
• https://github.com/thorsten/phpMyFAQ/commit/44cd20f86eb041f39d1c30a9beefad1cc61dc0ec patch