[MEDIUM] phpMyFAQ: Public API endpoints expose emails and invisible questions

PKSA-2sk9-r8yw-1gc5 CVE-2026-24422 GHSA-j4rc-96xj-gvqc

Affected package: thorsten/phpmyfaq

Affected version: <=4.0.16

Reported by:
GitHub