CyberRota
Back to database

CVE-2026-35676

HIGH · CVSS 8.2 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published: 2026-05-28 · Last synced: 2026-06-27

CyberRota Analysis

Detaylı analiz gerekiyor.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-35676
Severity
HIGH
CVSS
8.2
EPSS
0.24%

Original NVD Description

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.