CVE-2026-111887
5.3 MEDIUMpublic exploit availablePublished 2026-10-17 · Updated 2026-10-17
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- LOWCVE-2026-102587
- LOWCVE-2026-103526
- MEDIUMCVE-2026-104439PoC
- MEDIUMCVE-2026-105664PoC
- MEDIUMCVE-2026-107843PoC
- MEDIUMCVE-2026-109206PoC
- MEDIUMCVE-2026-110310PoC
- CRITICALCVE-2026-111235PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.