CVE-2026-48488

LOW EPSS 8.0%

Published Jun 8, 20263w ago · Modified Jun 17, 20262w ago

2.7 CVSS 4.0

Low

Published Jun 8, 2026 3w ago

Last Modified Jun 17, 2026 2w ago

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

CVSS Details

Base Score

2.7

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

8.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-328

References 2

github.com https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
github.com https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.