Main Vulnerability Database Exploits ID:12339 - Exploit for Improper access control in phpMyFAQ - CVE-2026-24420

ID:12339 - Exploit for Improper access control in phpMyFAQ - CVE-2026-24420

Published: January 26, 2026

Vulnerability identifier: #VU122034

Vulnerability risk: Medium

CVE-ID: CVE-2026-24420

CWE-ID: CWE-284

Exploitation vector: Remote access

Vulnerable software:
phpMyFAQ

Link to public exploit:

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7p9h-m7m8-vhhv/#poc

Vulnerability description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to a permissive permission check in attachment.php. A remote user can bypass implemented security restrictions and download FAQ attachments.

Remediation

Install updates from vendor's website.