CVE-2026-48488
NoneCVSS
—
EPSS
0.3%
Published
Jun 8, 2026
CISA due date
—
The record
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-41879 R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. CWE-328
- CVE-2026-14738 A security flaw has been discovered in exo-explore exo up to 1.0.71. CWE-328
- CVE-2026-14742 A vulnerability was determined in langchain-ai langgraph up to 1.2.4. CWE-328
- CVE-2026-14630 A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0. CWE-328
- CVE-2026-13455 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to… CWE-328
- CVE-2026-54266 Angular is a development platform for building mobile and desktop web applications using… CWE-328
- GHSA-39pv-4j6c-2g6v @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to… CWE-328
- CVE-2026-11481 A vulnerability was determined in yoanbernabeu grepai up to 0.35.0. CWE-328