CVE-2025-59943 json
phpMyFAQ duplicate email registration allows multiple accounts with the same email
published 2025-10-03 13 mo ago modified 2026-10-08 31 d ago also EUVD-2025-32505 , GHSA-9wj2-4hcm-r74j
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.
Patch / fix
- packagist thorsten/phpmyfaq 4.0.13
- phpmyfaq phpmyfaq 4.0.13
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 13 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9wj2-4hcm-r74j referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | thorsten/phpmyfaq | >=4.0.7, <4.0.13 |
4.0.13 |
Affected products
- thorsten phpMyFAQ
Classification
References
-
github.com
/thorsten/phpMyFAQ/commit/44cd20f86eb041f39d1c30a9beefad1cc61dc0ec
web, patch
-
github.com
/thorsten/phpMyFAQ/security/advisories/GHSA-9wj2-4hcm-r74j
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-59943
advisory
-
github.com
/thorsten/phpMyFAQ
package
Sources
- CVE List CVE-2025-59943
- GitHub Advisory GHSA-9wj2-4hcm-r74j
- NVD CVE-2025-59943
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.