Vulnerabilities CVE-2026-75920

CVE-2026-75920

Medium

Open

TLP:CLEAR

phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

Details

CVSS Score: 6.0
CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 19, 2026
Last Modified: Aug 20, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.