CVE-2026-48488 - phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

Back Back to CVE browser

LOW

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

Published Jun 8, 2026

2.7

LOW

CVSS 4.0

EPSS 0.28%

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

Affected products

Vendor Thorsten Product phpMyFAQ Default
unknown
Affected
- < 4.1.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Thorsten	phpMyFAQ	unknown	Affected < 4.1.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-328

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35091
Advisory
https://github.com/advisories/GHSA-58fg-62fg-3fcj
Advisory
https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
x_refsource_MISC
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-48488

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35091		Advisory
https://github.com/advisories/GHSA-58fg-62fg-3fcj		Advisory
https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718		x_refsource_MISC
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-48488