Is CVE-2026-34973 actively exploited?

No active exploitation of CVE-2026-34973 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34973 be exploited remotely?

Yes. CVE-2026-34973 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34973?

CVE-2026-34973 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34973

MEDIUM

CVE-2026-34973

CWE-943Published: April 2, 2026· Updated: Apr 6, 2026

5.3

CVSS v3.1

EPSS:0.09%probability of exploitation in 30 daysPercentile:25.7th

Official Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure. This issue has been patched in version 4.1.1.

NVD Source

Technical Analysis

CVE-2026-34973 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.