Search/CVE-2026-85586
● CVE

CVE-2026-85586

DiscoveredSep 4, 2026UpdatedSep 10, 2026

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

View graph Watch Export
CVSS v3.1
—
EPSS
0.49%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 6, 2026 → Sep 25, 2026
▲ 0.13pp
0.36% → 0.49% over 2 tracked changes
Connections
1 relationships
Timeline
disclosure → media coverage
Sep 4, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 10, 2026