Live › vulnerability › CVE-2026-111892
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta does not effectively rate limit its unauthenticated password update and reset endpoints. An unauthenticated attacker can send unlimited reset requests, flooding a registered user's inbox and exhausting mailer and server resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that expose the password reset endpoints to unauthenticated visitors are affected. Installations on an earlier or later release, or where those endpoints are not reachable from outside, have less exposure.
No product ranges from the sources yet.
grep -i version phpmyfaq/inc/Constants.php or the admin dashboard, and see whether it is in the range 4.2.0-alpha up to but not including 4.2.0-beta.4.2.0-beta or later, as the description states the flaw is fixed there.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-111892")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.