thorsten/phpmyfaq before 3.1.9 is vulnerable to SQL Injection inside instance name that leads to Remote Code Execution. An attacker has a severe impact by being allowed to recover all or part of your database (including sensitive data like usernames and passwords hash), Modify or insert data in the database, saturate database workers with resource-intensive math functions, read or write files on the disk and execute OS commands.