CVE-2025-62519 phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Authenticated users with configuration edit permissions can execute arbitrary SQL commands, leading to database compromise and potential remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62519?
CVE-2025-62519 is a high-severity SQL injection vulnerability in Phpmyfaq Phpmyfaq, published on 17 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.
Weakness: CWE-89
Which versions are affected by CVE-2025-62519?
4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpmyfaq/phpmyfaq Packagist | All versions | 4.0.14 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.0.14 |
thorsten/phpmyfaq Packagist | All versions | 4.0.14 |
thorsten/phpmyfaq Packagist | All versions | 4.0.14 |
Products include Phpmyfaq Phpmyfaq.
How do I fix CVE-2025-62519?
Upgrade phpmyfaq/phpmyfaq to 4.0.14 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-62519 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62519 exists.
Other vulnerabilities in Phpmyfaq Phpmyfaq
- CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
- CVE-2017-11187 Security feature bypass in n/a
- CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
- CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
Sources
Also known as GHSA-fxm2-cmwj-qvx4.