Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
phpMyFAQ Exposure of Sensitive Information Through Data Queries Vulnerability - CVE-2025-69200 - Vulnerability Database
phpMyFAQ

phpMyFAQ Exposure of Sensitive Information Through Data Queries Vulnerability - CVE-2025-69200

High
Reference: CVE-2025-69200
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-69200
Title: phpMyFAQ Exposure of Sensitive Information Through Data Queries Vulnerability
Overview:

phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16 an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g. database.php with database credentials) leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.