CyberRota
Back to database

CVE-2026-45010

CRITICAL · CVSS 9.1 EPSS 0.15% Public Exploit

Source: NVD + CISA KEV + EPSS · Published: 2026-05-15 · Last synced: 2026-06-09

CyberRota Analysis

Detaylı analiz gerekiyor.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-45010
Severity
CRITICAL
CVSS
9.1
EPSS
0.15%

Original NVD Description

phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.