CVE-2026-34729 — phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there…

CVE-2026-34729 — phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there…

Image via opengraph.githubassets.com

🚨 CVE-2026-34729 phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.

What This Means For You

  • New vulnerability disclosed — verify if your stack is exposed.
  • New tool or resource available — evaluate for your security workflow.

Related ATT&CK Techniques

🛡️ Detection Rules

1 rule · 6 SIEM formats

1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.

high T1190 Initial Access

Web Application Exploitation Attempt — CVE-2026-34729

Sigma YAML — free preview

Source: Shimi's Cyber World · License & reuse

Indicators of Compromise

IDTypeIndicator
CVE-2026-34729 XSS phpMyFAQ version prior to 4.1.1, Stored XSS via Regex Bypass in Filter::removeAttributes()
Source & Attribution
Source PlatformTelegram
ChannelCVE Notify
PublishedApril 07, 2026 at 17:56 UTC

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.

Related coverage

Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities

Ubiquiti has rolled out critical security updates addressing three maximum severity vulnerabilities in UniFi OS. BleepingComputer reports these flaws, tracked as CVE-2023-48092, CVE-2023-48093, and CVE-2023-48094,...

threat-inteldata-breachmalwarevulnerabilitytools
/SCW Vulnerability Desk /MEDIUM /⚑ 3 IOCs /⚙ 1 Sigma

Megalodon GitHub Attack: 5,561 Repos Hit with Malicious CI/CD Workflows

The Hacker News reports a new automated campaign, dubbed Megalodon, that injected 5,718 malicious commits into 5,561 GitHub repositories within a mere six-hour window. This...

threat-intelvulnerabilitytools
/SCW Vulnerability Desk /MEDIUM /⚑ 3 IOCs /⚙ 3 Sigma

WordPress Ditty Plugin: Authorization Bypass Exposes Non-Public Content

CVE-2026-9011 — The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...

vulnerabilityCVEhigh-severitycwe-862
/SCW Vulnerability Desk /HIGH /7.5 /⚑ 3 IOCs