CVE-2026-111892
medium
CVSS 6.5
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user...
Summary
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user...
Original description
The description as published by the source.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com