CVE-2025-59943
published 2025-10-03CVE-2025-59943: phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.39%
30.6th percentile
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpmyfaq | phpmyfaq | — | — |
| thorsten | phpmyfaq | — | — |
| thorsten | phpmyfaq | >= 4.0.7 < 4.0.13 | 4.0.13 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
phpMyFAQ duplicate email registration allows multiple accounts with the same email
ghsa·2025-10-03
CVE-2025-59943 [HIGH] CWE-284 phpMyFAQ duplicate email registration allows multiple accounts with the same email
phpMyFAQ duplicate email registration allows multiple accounts with the same email
### Summary
phpMyFAQ does not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover.
### Details
An account management logic flaw in phpMyFAQ allows attackers to register multiple accounts under the same email address. If email is used for password reset or administrative flows, this may result in account takeover, loss of accountability, and abuse of business logic.
### PoC
1.Register a user wi
OSV
phpMyFAQ duplicate email registration allows multiple accounts with the same email
osv·2025-10-03
CVE-2025-59943 [HIGH] phpMyFAQ duplicate email registration allows multiple accounts with the same email
phpMyFAQ duplicate email registration allows multiple accounts with the same email
### Summary
phpMyFAQ does not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover.
### Details
An account management logic flaw in phpMyFAQ allows attackers to register multiple accounts under the same email address. If email is used for password reset or administrative flows, this may result in account takeover, loss of accountability, and abuse of business logic.
### PoC
1.Register a user wi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-03
Published