phpMyFAQ uses SHA-1 to hash attachment passwords prior to version 4.1.4, a weak hash algorithm vulnerable to collision attacks. This weakness makes it easier for an attacker to forge or recover passwords, potentially allowing unauthorized access to protected attachments. The flaw is categorized as CWE-328, reflecting a broken cryptographic primitive.

Industry‑wide, Thorsten’s phpMyFAQ application is affected in all releases before 4.1.4. Users of earlier versions must acknowledge the risk; newer releases are unaffected.

The CVSS score of 2.7 indicates low severity, and no EPSS score is available. The flaw lies in the password hashing layer, so exploitation requires access to the password storage or brute‑force attempts, not a remote attack vector. Because the vulnerability is not listed in CISA’s KEV catalog, widespread active exploitation is not known. The most likely threat comes from a local or privileged attacker who can obtain the hashed passwords and attempt to reverse them using the weakened SHA-1 hash.