CVE-2026-46364: critical vulnerability in thorsten phpmyfaq
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
Published · Updated
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 2.1%
exploitation probability
2.1%top 19% of all CVEs
observed exploitation
nono source reports it
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
thorsten · phpmyfaqRelated CVEs — thorsten phpmyfaq
In the same product, most dangerous first.
CVE-2026-45010CRITICALphpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check EndpointEPSS 0.6%CVE-2026-46362HIGHphpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission CheckEPSS 0.5%CVE-2026-45008HIGHphpMyFAQ - Path Traversal in Client::deleteClientFolder via URL ParameterEPSS 0.5%CVE-2026-46366HIGHphpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission BypassEPSS 0.4%CVE-2026-46359HIGHphpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token FieldsEPSS 0.4%CVE-2026-46361HIGHphpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twigEPSS 0.3%