We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-35672

CVE-2026-35672

PHP

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-05-28
Last modified: 2026-05-28
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE: CWE-1188

Description

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token

Summary

Description

References