[GHSA] GHSA-6pvm-2vjj-rx4w (medium) — phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

GHSA-6pvm-2vjj-rx4w Severity: medium CVE: CVE-2026-47132

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

### Summary

An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syn