CVE-2025-69200
HIGH EXPLOITED NUCLEIphpMyFAQ < 4.0.16 - Unauthenticated Sensitive Information Exposure via Backup API
Title source: llmExploitation Summary
CVE-2025-69200 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.
Nuclei Templates (1)
phpMyFAQ - Configuration Backup Disclosure
HIGHVERIFIEDby Louay-075
Shodan:
http.title:"phpMyFAQ"
References (2)
Core 2
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg
Scores
CVSS v3
7.5
EPSS
0.0267
EPSS Percentile
86.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
VulnCheck KEV
2026-01-18
CWE
CWE-202
Status
published
Products (3)
phpmyfaq/phpmyfaq
4.1.0 rc
phpmyfaq/phpmyfaq
< 4.0.16
thorsten/phpmyfaq
0 - 4.0.16Packagist
Published
Dec 29, 2025
Tracked Since
Feb 18, 2026