[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions

PKSA-g4rh-637x-8kby CVE-2026-24422 GHSA-j4rc-96xj-gvqc

Affected package: phpmyfaq/phpmyfaq

Affected version: <=4.0.16

Reported by:
GitHub