https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T20:52:57.056291+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111884 fkie_cve-2026-111884 2026-10-20T20:52:57.058681+00:00

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

 https://db.gcve.eu/vuln/ghsa-ch92-qpmj-fc56 GHSA-ch92-qpmj-fc56 2026-10-20T20:52:57.058770+00:00

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.