CVE-2026-85586
NoneCVSS
—
EPSS
0.5%
Published
Sep 4, 2026
CISA due date
—
The record
phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows… CWE-799
- CVE-2026-54738 Lemmy is a link aggregator and forum for the fediverse. CWE-799
- CVE-2026-75773 A vulnerability was found in karakeep-app karakeep up to 0.32.0. CWE-799
- CVE-2026-19898 A vulnerability was found in VictoriaMetrics up to 1.146.0. CWE-799
- CVE-2026-19897 A vulnerability has been found in mangroup dtale up to 3.22.0. CWE-799
- CVE-2026-19895 A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. CWE-799
- CVE-2026-5233 Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. CWE-799
- CVE-2026-10216 A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. CWE-799