Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-75920

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.5%
CVSS Severity
CVSS v3 Score 5.3
Products affected by CVE-2026-75920


Contact Us

Shodan ® - All rights reserved