Threats tagged 'ghsa-6pvm-2vjj-rx4w'

phpMyFAQ version 4.2.0-alpha contains an authenticated SQL LIKE wildcard injection vulnerability in its chat user search API. This flaw allows any logged-in user to inject SQL LIKE wildcards (%) and (_) into search queries, bypassing intended display-name filtering and enabling enumeration of active user IDs and display names. The vulnerability is due to improper escaping of SQL LIKE metacharacters. A patch is available to address this issue. The vulnerability has a medium severity with a CVSS score of 5.4.