Threats Tagged 'ghsa-6pvm-2vjj-rx4w'
View all threats tagged with 'ghsa-6pvm-2vjj-rx4w'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-6pvm-2vjj-rx4w'
Click on any threat for detailed analysis and mitigation recommendations
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration (CVE-2026-47132)CVE-2026-47132 0 phpMyFAQ version 4.2.0-alpha contains an authenticated SQL LIKE wildcard injection vulnerability in its chat user search API. This flaw allows any logged-in user to bypass the intended display-name filtering by injecting SQL LIKE wildcards (%) and (_) into the search query. As a result, an attacker can enumerate active user IDs and display names, potentially disclosing sensitive internal user information. The vulnerability arises because the input escaping does not neutralize SQL LIKE metacharacters, unlike safer patterns used elsewhere in the product. A proof of concept demonstrates how queries with wildcards return all active users, whereas normal queries do not. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity). A patch is available for this issue. Join the discussion | GCVE Database | 08/12/2026, 15:17:54 UTC Added: 08/12/2026, 16:11:24 UTC |
Showing 1 to 1 of 1 result