phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

概要

public function setPassword(string $password): void
{
    $this->passwordHash = password_hash($password, PASSWORD_BCRYPT);
}

public function verifyPassword(string $plainPassword): bool
{
    return password_verify($plainPassword, $this->passwordHash);
}

参考情報

• thorsten/phpMyFAQ security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-48488 · ADVISORY
• thorsten/phpMyFAQ commit 1aa9be6 · WEB
• thorsten/phpMyFAQ · PACKAGE

phpmyfaq/phpmyfaq のその他の脆弱性

• CVE-2026-56738高 8.5phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement usin…
• CVE-2026-56737高 8.1phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authe…
• CVE-2026-56736高 8.2phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows an…
• CVE-2026-57994中 5.3phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthent…
• CVE-2026-57961低 2.7phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ…