{"advisories":[{"id":"GHSA-9cg9-4h4f-j6fg","source":"ghsa","title":"phpMyFAQ has unauthenticated config backup download via /api/setup/backup","url":"https://github.com/advisories/GHSA-9cg9-4h4f-j6fg"}],"cve":"CVE-2025-69200","enrichment":{"created":"2025-12-29T22:32:54.629283+00:00","updated":"2025-12-29T22:32:54.629315+00:00","vendors":["thorsten","thorsten$PRODUCT$phpmyfaq"]},"epss":{"score":0.02141},"mitre":{"cpes":[],"created":"2025-12-29T15:24:51.844000+00:00","description":"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/69xxx/CVE-2025-69200.json","references":["https://github.com/thorsten/phpMyFAQ/commit/b0e99ee3695152115841cb546d8dce64ceb8c29a","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg"],"title":"phpMyFAQ has unauthenticated config backup download via /api/setup/backup","updated":"2025-12-29T16:14:32.476000+00:00","vendors":[],"weaknesses":["CWE-202"]},"nvd":{"cpes":["cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*","cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*"],"created":"2025-12-29T16:15:43.793000+00:00","description":"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-69200.json","references":["https://github.com/thorsten/phpMyFAQ/commit/b0e99ee3695152115841cb546d8dce64ceb8c29a","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg"],"title":null,"updated":"2026-06-17T10:00:16.470000+00:00","vendors":["phpmyfaq","phpmyfaq$PRODUCT$phpmyfaq"],"weaknesses":["CWE-202"]},"opencve":{"changes":[{"created":"2025-12-29T15:45:00+00:00","data":[{"details":{"new":"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.","old":null},"type":"description"},{"details":{"new":"phpMyFAQ has unauthenticated config backup download via /api/setup/backup","old":null},"type":"title"},{"details":{"added":["CWE-202"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/thorsten/phpMyFAQ/commit/b0e99ee3695152115841cb546d8dce64ceb8c29a","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"eb50899d-6e6b-4721-986c-f77d9948e6ac"},{"created":"2025-12-29T17:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"f822de0b-8619-4b91-8bc2-e005d533fbee"},{"created":"2025-12-29T23:15:00+00:00","data":[{"details":["thorsten","thorsten$PRODUCT$phpmyfaq"],"type":"first_time"},{"details":{"added":["thorsten","thorsten$PRODUCT$phpmyfaq"],"removed":[]},"type":"vendors"}],"id":"b040f76c-c5f8-4df8-8b20-b35fc0747ee2"},{"created":"2026-01-07T15:45:00+00:00","data":[{"details":["phpmyfaq","phpmyfaq$PRODUCT$phpmyfaq"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*","cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["phpmyfaq","phpmyfaq$PRODUCT$phpmyfaq"],"removed":[]},"type":"vendors"}],"id":"31f26e92-b081-4f8d-acaf-3f7f6365497a"}],"cpes":{"data":["cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*","cpe:2.3:a:phpmyfaq:phpmyfaq:4.1.0:rc:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2025-12-29T15:24:51.844000+00:00","provider":"mitre"},"description":{"data":"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.02141},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/thorsten/phpMyFAQ/commit/b0e99ee3695152115841cb546d8dce64ceb8c29a","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg"],"providers":["mitre","nvd"]},"title":{"data":"phpMyFAQ has unauthenticated config backup download via /api/setup/backup","provider":"mitre"},"updated":{"data":"2026-01-07T15:35:10.527000+00:00","provider":"nvd"},"vendors":{"data":["phpmyfaq","phpmyfaq$PRODUCT$phpmyfaq","thorsten","thorsten$PRODUCT$phpmyfaq"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-202"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-12-29T15:24:51.844000+00:00","description":"phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"phpMyFAQ has unauthenticated config backup download via /api/setup/backup","updated":"2025-12-29T16:14:27.556000+00:00","vendors":[],"vulnrichment_repo_path":"2025/69xxx/CVE-2025-69200.json","weaknesses":[]}}