CVE-2025-69200
Phpmyfaq ≤ 4.0.16
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-69200 is a high-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Phpmyfaq Phpmyfaq. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked in the top 21% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-23 (Data Mining Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
phpMyFAQ is an open source FAQ web application affected by an information disclosure vulnerability in all versions prior to 4.0.16. The flaw allows generation of a configuration backup ZIP archive containing sensitive files such as database.php through an unauthenticated POST request to /api/setup/backup; the resulting archive is placed in a web-accessible location and can be downloaded directly.
An unauthenticated remote attacker can exploit the issue over the network with low complexity to obtain database credentials and other configuration data, enabling high-impact information disclosure and potential follow-on compromise of the application and its underlying database.
The official fix is included in phpMyFAQ 4.0.16, as noted in the project's GitHub security advisory GHSA-9cg9-4h4f-j6fg and the corresponding commit that addresses the backup endpoint exposure.
EPSS for the CVE rose from a low baseline to a peak of 0.0555 on 2026-04-27 before receding to the current value of 0.0267, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205600
Vulnerability Data
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP…
more
contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-23 directly requires mechanisms to protect against unauthorized data mining and inference from statistical queries that would expose sensitive information.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege query permissions directly limit the data an attacker can request or infer.
Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.
Protecting data-in-use reduces what remains available for inference via queries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control limits who can run queries that could expose sensitive information via inference.
Granular access rights reduce the ability of users to craft inference queries.
Data masking prevents inference by obscuring sensitive values returned in query results.
Information access restriction directly limits query scope that could lead to inference.
Classification helps identify sensitive data that must be protected from inference attacks.
DLP can detect and block queries or result sets that risk exposing sensitive information.