CVE-2025-62519 - CVE House

Back to Database

Status published High CVE-2025-62519

phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

7.2 CVSS

Vulnerability Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62519

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from thorsten

View All →

phpMyFAQ has unauthenticated config backup download via /api/setup/backup

phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

phpMyFAQ duplicate email registration allows multiple accounts with the same email

phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

Affected Vendor

thorsten

View all reports →

Affected Software

phpMyFAQ

Vulnerable Versions:

< 4.0.14

Timeline

Official Publish: November 17th, 2025

Last Modified: November 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction