CVE-2026-48488

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

• CWE-328

• https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48480The netty incubator codec.bhttp is a java language binary ht…6.6
• CVE-2026-48482GLPI is a free asset and IT management software package. Fro…9.4
• CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
• CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
• CVE-2026-48486Signum Node is a HDD-mined cryptocurrency using an energy ef…7.5
• CVE-2026-48487Zeroconf is a pure Python implementation of multicast DNS se…5.3
• CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1
• CVE-2026-48490ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2026-48491Traefik is an HTTP reverse proxy and load balancer. From 3.7…10
• CVE-2026-48492Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-48493Snipe-IT is an IT asset/license management system. In versio…5.5